Security & Testing Agent Skills for Windsurf (legacy)

Design and review server-side authorization for users, services, organizations, resources, and individual fields.

Autonomous PriorityClaw skill. Dynamically rescores the testing queue based on live WAF feedback, putting high-success probability…

This skill automates API endpoint testing, including request generation, validation, and comprehensive test coverage for REST and GraphQL…

Automates the enrichment of raw indicators of compromise with multi-source

Conducts autonomous, cross-layer end-to-end testing to uncover business logic bugs across API, UI, and database layers with detailed…

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege…

Automated compliance checking against CIS, PCI-DSS, HIPAA, and SOC 2 benchmarks

Comprehensive security and compliance scanning for AWS CDK projects.

AI-powered E2E web testing — eyes and hands for AI coding tools.

Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage.

BackstopJS visual regression testing for self-hosted visual comparison

Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need…

Apply BambooHR security best practices for API keys, webhook verification,

Diagnosis loop for bugs and performance regressions.

Blind-test how a skill or prompt change affects agent behavior before promoting it.

Apply after completing a task, before declaring done.

Executes and debugs baserCMS PHPUnit unit test suites in Docker environments for core and standalone plugins.

Companion to bb-ops/playbooks/{prompt-injection,indirect-prompt-injection}.yaml.

Companion to bb-ops/playbooks/{idor,broken-access-control,jwt,oauth,auth-bypass}.yaml.

Companion to the handoff agent. These are the rules for writing tasks the human will actually execute.

Companion to bb-ops/playbooks/{business-logic,race-condition}.yaml.