Security & Testing Agent Skills for Windsurf (legacy)

Assemble the evidence bundle, the sampling and the workpapers an auditor asks for, for one framework over one audit window, from Noru's…

Audits a project folder's AI harness maturity — state/memory, execution environment, control/enforcement, context management…

Looks up curated web security learning resources (XSS, SQLi, CSRF, SSRF, OAuth/JWT, deserialization, SAML, recon, evasion, defensive…

Run Playwright tests at scale with cloud-hosted browsers and integrated Azure portal reporting.

Expert in secure backend coding practices specializing in input validation, authentication, and API security.

Produce a STRIDE threat model for a system or feature.

Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants…

Streamlines vulnerability triage, patch development, and pull request workflows for baserCMS GitHub Security Advisories.

Companion to bb-ops/playbooks/{ssrf,cloud-imds,config-review,secret-discovery,springboot}.yaml.

Companion to bb-ops/playbooks/{sqli,nosqli,cmdi,ssti,lfi,xxe,deserialization,rce}.yaml.

Behavior-Driven Development as a collaboration and specification practice, with pytest-bdd and behave as the bundled automation references.

X-ray any AI model's behavioral patterns — refusal boundaries, hallucination tendencies, reasoning style, formatting defaults.

Use for JS/TS performance-sensitive changes, benchmark additions, benchmark regressions, benchmark result JSON, or any claim that code is…

Build, verify and evaluate evidence-backed protocol-agent releases: pin a document corpus by digest, prove citations as exact bytes, bind…

Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.

BiSheng C non-null pointers and nullability.

Build production-ready Web3 applications, smart contracts, and decentralized systems.

Ensure async-path backend code that could block the asyncio event loop is protected by a teeth-verified runtime anchor in…

Full safety mode: destructive command warnings + directory-scoped edits.

Master Test Architect and Quality Advisor.

Bootstrap/set up a Gatling project to get started with Gatling load tests.