Security & Testing Agent Skills for Codex CLI

Comprehensive testing strategies for test-driven development and ensuring high-quality Go code.

Red team tactics principles based on MITRE ATT&CK.

4-phase systematic debugging methodology with root cause analysis and evidence-based verification.

Test-Driven Development workflow principles.

Testing patterns and principles. Unit, integration, mocking strategies.

Advanced vulnerability analysis principles.

Web application testing principles. E2E, Playwright, deep audit strategies.

Agent skill for implementer-sparc-coder - invoke with $agent-implementer-sparc-coder

Code-vs-spec comparator. Reads the source first-hand and compares it against written specification documents, classifying every divergence…

Iteratively review an instar-development spec with multi-angle internal reviewers (security, scalability, adversarial, integration…

Enforces rigorous code quality standards by performing multi-layered static analysis on git diffs during the code review process.

Static Analysis Aggregator - Run applicable static, configuration, container, security, and stack checks with evidence.

Identity and Access Engineer - Design and implement secure authentication, authorization, federation, provisioning, sessions, and account…

Logic Challenger (Red Team) - Ask critical questions, find edge cases.

Security Auditor - Perform evidence-backed application, dependency, secret, and threat-model audits without silently modifying code.

Test Runner & Coverage - Design and run evidence-backed tests for requirements, regressions, and failure paths.

Install a pre-commit hook that scans .specstory/history for secrets before commits.

Set up Spectron (deprecated) tests for legacy Electron application testing

Guides automated testing of SPIP plugins and squelettes using PHPUnit — the standard test tool for SPIP.

Test-driven development for Spring Boot using JUnit 5, Mockito, MockMvc, Testcontainers, and JaCoCo.

Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or…