Security & Testing Agent Skills for Claude Code

Web security headers validation and configuration generation

Comprehensive security patterns for authentication, authorization, input validation, and common vulnerability prevention

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and…

Implements authentication, authorization, encryption, secrets management, and security hardening patterns.

Use when reviewing software, infrastructure, dependencies, or release surfaces for security findings only.

Evaluates customer security questionnaires against available evidence, identifies deal-blocking compliance gaps, and schedules remediation…

Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove…

When to activate: security review, SAST, static analysis, Semgrep, Bandit, CodeQL, dependency audit, secrets detection, vulnerability…

Use when performing a security review or triaging findings before launch.

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance.

Dependency vulnerability sweep for a Tessellate app — runs npm audit + Dependabot, separates real advisories from chain noise, classifies…

Conducts systematic security analyses using methodologies like STRIDE to identify vulnerabilities in software architectures and propose…

Honestly evaluate AI work quality using a two-axis scoring system.

Explicit-only investigation and optional causal fix for hard, intermittent, performance, environment-only, production-only, or otherwise…

Test-driven development. Use only when the user explicitly requests TDD, test-first work, or RED-GREEN-REFACTOR, or applicable repository…

Write and debug Storybook stories and Chromatic snapshots for apps/web.

Run a managed pentest of a web app or API through the app.strix.ai REST API — no local Docker, LLM key, or install needed.

Surface the structural truth of the codebase: coupling, cycles, dead code, parallel implementations, deprecated paths, abandoned…

Verify that functionality migrated from Struts 2 to Spring works correctly in the running application from the API, client, and user…

TanStack React Start auth patterns with @clerk/tanstack-react-start

Use only when the user explicitly asks for TDD, a failing test, or a regression test, OR when the bug has an obvious cheap local test…