Security & Testing Agent Skills for Windsurf (legacy)

Companion to verifier + bypass-researcher roles.

Companion to bb-ops/playbooks/{xss,xss-dalfox,dom-xss,cors,open-redirect,config-review,csrf,file-upload,http-smuggling,cache-poison,host-he…

Use when facilitating BDD collaboration between developers, testers, and business stakeholders.

Change-impact and completion audit for wide, risky, cross-cutting, or merge-critical work.

Safety guardrails for destructive commands.

This skill should be used when the user invokes the bridge-check command or asks to verify the isolated Devin bridge.

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit)…

Standardizes vulnerability reporting with triager-friendly formats, calibrated severities, and reproducible evidence.

Proactively hunt the codebase for bugs of every size — major reliability bugs (connection/network failures, missing timeouts, unhandled…

Full bug hunt cycle — dispatch 4 sibling bug-hunter methodology skills in parallel, cross-validate findings, present design decisions, and…

Find correctness bugs in source code through differential and invariant-based analysis.

Evaluates bug fixes by diagnosing root causes, tracing call-chain and data-flow impacts, and assessing regression risks before code…

Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists…

Use when writing, reviewing or auditing an end-to-end acceptance suite, especially one that was bulk-generated.

Builds vendor-agnostic detection rules using the Sigma rule format for

Build effective detection rules using Splunk Search Processing Language

Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID…

Generate log2timeline and Plaso super-timelines and triage them in Timesketch.

Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating…

Builds automated threat intelligence feed integration pipelines connecting

Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and…