Security & Testing Agent Skills for Claude Code

Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.

Use when checking this repository's skills for security or quality issues before sharing them, or remediating findings across skills.

Monitors Certificate Transparency (CT) logs to detect unauthorized certificate

Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable…

This skill should be used when the user asks "are our tests actually good", "is 100% coverage meaningful", "what is mutation testing"…

Use when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature…

This skill should be used when the user asks about "authentication in Next.js", "NextAuth", "Auth.js", "middleware auth", "protected…

Design and review secure authentication and credential lifecycles.

Design and review server-side authorization for users, services, organizations, resources, and individual fields.

This skill automates API endpoint testing, including request generation, validation, and comprehensive test coverage for REST and GraphQL…

Automated compliance checking against CIS, PCI-DSS, HIPAA, and SOC 2 benchmarks

Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage.

Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need…

Apply BambooHR security best practices for API keys, webhook verification,

Diagnosis loop for bugs and performance regressions.

Blind-test how a skill or prompt change affects agent behavior before promoting it.

Apply when debugging. Trace each symptom to its root cause and fix it there; reproduce first, ask why until you reach it, resist nil-check…

Test-driven development with red-green-refactor loop.

Use when facilitating BDD collaboration between developers, testers, and business stakeholders.

Independent local multi-model review for contested, security-sensitive, high-risk, or merge-critical plans and changes.

Bug condition/postcondition formalization as testable Behavior Contracts.