Security & Testing Agent Skills for Zed

Route Node.js/TypeScript backend security questions to the matching OWASP Top 10 category and the correct library reference (express…

OWASP Top 10 vulnerability scanning and remediation

This skill should be used when running or interpreting an OWASP ZAP baseline DAST scan of the Expo web export — after changes to HTTP…

Use when hardening JavaScript npm dependencies against fresh package publishes, supply-chain attacks, typosquatting windows, compromised…

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session…

Apply after completing a task, before declaring done.

Run macOS Parallels smoke with Discord send, host verification, host reply, and guest readback proof.

Use when you need to evaluate the strength of a password or passphrase, give actionable improvement advice, or explain password policy…

When to activate: penetration testing, pentest, OWASP testing, Burp Suite, web vulnerabilities, SQLi, XSS, IDOR, security assessment…

Performs two perfection passes plus polish for moderate code refinement with cleanup.

Performs three perfection passes plus polish for maximum code refinement with cleanup.

Run a critical, multi-dimensional performance review with parallel agents across algorithmic complexity, memory/allocation, data access &…

Full performance audit cycle — dispatch the sibling performance-audit skill (parallel perf lanes + execution-cost map), cross-validate…

Design performance test cases and test data specifications for an entire system — from raw system documentation (BRD, FRD, use cases…

Conducts red team operations using the Covenant C2 framework for authorized

Organizes and sorts permission allowlists for AI agents, tools, and services hierarchically without altering rule definitions.

Persona Auditor audits AI-generated code from the perspective of real users, surfacing the errors you would only discover through costly…

Write Playwright E2E tests for the Phoenix AI observability platform.

Write, extend, and debug PXI Playwright E2E tests for Phoenix.

Spin up a live local Omnigent server + runner and exercise the native Pi TUI harness (pi-native) end-to-end — launch the real `pi` CLI via…

Review one research paper for nine LLM-security methodological pitfalls (data poisoning, label inaccuracy, data leakage, model collapse…