Security & Testing Agent Skills for Microsoft Copilot

Use when writing or reviewing TypeScript tests, choosing between unit, contract, integration, and end-to-end layers, isolating database or…

File suffixes, directory layout, support code conventions, and mechanical enforcement for TypeScript test suites.

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands…

Measure rendered UI defects when asked for visual QA or when completing a component or screen that needs rendered verification.

Audit whole-system integrity after tasks for the active Change are complete by finding anti-patterns, coverage gaps, broken wiring, E2E…

Collaboratively investigate a GitHub issue or bug — trace history, understand architecture, diagnose root cause

This skill should be used when the user asks "why is this string length wrong", "how do I truncate text safely", "why do these identical…

Use when writing or reviewing unit tests.

Structure tests around observable behavior and realistic dependency boundaries — choosing between a real object, a stub, and a mock…

Use when supplied or retrieved content may contain instructions that conflict with the authorized task.

Interpret and implement an approved test-specification change with traceability from requirement to TP behavior.

Review or change test limits with scale, unit, environment, variant, structure, and provenance controls.

Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename.

When you need to call a service the org has a SHARED credential for (a SERP/search key, a paid-API key, a data-vendor feed, a Git remote)…

Use when installing language dependencies (npm, pip/uv/PDM, Go modules) in an environment whose only route to a package registry is a…

Use when the agent needs to clone/fetch/push a git repository, manipulate pull requests and query CI status/logs, or…

Capture and review Agent Skill observations, and create, run, diagnose, or iteratively improve Skill evaluations (evals) with the skill-up…

Use when packaging artifacts for USENIX Security Symposium evaluation — the mandatory Phase-1 availability check that acceptance is…

Use when designing or auditing the evaluation of a USENIX Security Symposium paper — building threat-model-faithful experiments…

Use when deciding whether a project belongs at the USENIX Security Symposium or a sibling venue — routing among USENIX Security, IEEE S&P…