Security & Testing Agent Skills for Microsoft Copilot

Measure the review panel against fixtures whose defects are known in advance - catch rate and false-positive rate per lens.

Test-driven development with red-green-refactor loop.

Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and…

Implement or repair stable, observable software behavior through a compact verified test-first Red-Green-Refactor loop.

Add, remove, move, gate, bin, or restore tests and subplans in an active test flow while preserving dependencies and variant intent.

Use when changing software whose existing behaviour matters — fixing bugs or regressions, refactoring, migrating schemas or APIs, changing…

Use when planning, running, or learning from chaos engineering experiments.

This skill uses the owasp-compliance-checker plugin to automatically identify potential security vulnerabilities based on the OWASP Top 10…

Fix a bug from the issue tracker.

Demonstrate Inadequate Identity & Access Management (CICD-SEC-2) during an authorized assessment — abusing over-permissioned, stale, or…

Demonstrate Insufficient Logging & Visibility (CICD-SEC-10) during an authorized assessment — showing that malicious activity in the CI/CD…

Govern third-party services in the CI/CD ecosystem against CICD-SEC-8.

Harden a CI/CD pipeline against Poisoned Pipeline Execution (PPE / CICD-SEC-4).

Detect and prevent self-hosted CI runner abuse (CICD-SEC-7).

Minimize the admission of containers wishing to share the host network namespace (Automated)

Risk-paranoid interrogation of any plan that touches data, compliance, or production access.

Secure Clari API tokens and implement data handling best practices.

Generate the acceptance evidence a behavior module with ClarityKit artifacts needs — a transition-coverage checklist from the behavior…

Guides authentication and session security for classic CodeIgniter 2.x/3.x applications - session/cookie design, CSRF, and object-level…

Hardens Claude Code environments using a three-layer defense system to prevent prompt injection and secret leakage.

Verifies the authenticity and version of Claude models to detect proxies, wrappers, or downgraded AI versions.