Security & Testing Agent Skills for Claude Code

Scan skill files, CLAUDE.md, MCP configs, and agent prompts for prompt injection patterns

Root cause analysis with dependency tracing and call stack analysis

Use when you need to understand why capabilities differ across configurations, user types, or deployment environments, or when…

Analyzes, disassembles, and patches binary executables using the radare2 command-line tool suite for reverse engineering workflows.

Analyzes compiled binaries, obfuscated bytecode, firmware, and virtualized targets using static, dynamic, and symbolic execution techniques.

Smoke test Mastra projects locally or deploy to staging/production.

When to activate: C++ testing, Google Test, GTest, GMock, Catch2, doctest, fixtures, parameterized tests, benchmarks, mocking

When to activate: Go tests, table-driven tests, testify, mocks, subtests, benchmarks, fuzz testing, test helpers

When to activate: Kotlin testing, JUnit 5, Kotest, MockK, Testcontainers, coroutine testing, Spring test slices, runTest

When to activate: privacy by design, PbD, DPIA, data minimization, purpose limitation, privacy impact assessment, privacy engineering…

When to activate: pytest, TDD, test fixtures, parametrize, async tests, coverage, mocking, hypothesis

When to activate: Swift Testing framework, XCTest, unit tests, async tests, test macros, parameterized tests, Swift mocking

Use when reviewing the source code of an MCP server or client implementation — not just its runtime config — for authentication, session…

Guide secure migration of code from memory-unsafe languages (C, C++, Assembly) to memory-safe languages (Rust, Go, Java, C#, Swift).

Implement comprehensive testing strategies with pytest, fixtures, mocking, and test-driven development.

Design and implement automated tests for current Minecraft 26.x or legacy 1.21.x mods and plugins using JUnit, MockBukkit, NeoForge Game…

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain…

Review a repository, architecture, workflow, or local folder with a focus on MITRE ATT&CK-style adversary behavior.

Enforce and detect server-side the authorization and workflow rules a mobile client cannot be trusted to keep.

Add binary protections and, above all, remove client-side trust against OWASP Mobile Top 10 M7.

Abuse insecure deep links and inter-app entry points during an authorized mobile assessment.