48 skills available for 30+ AI coding agents
by qaskills
Testing Cross-Origin Resource Sharing configurations for misconfigurations, overly permissive policies, and credential handling vulnerabilities.
Automated compliance testing using Open Policy Agent, Chef InSpec, and custom policy engines for security baseline validation.
Automated scanning of project dependencies for known vulnerabilities using tools like npm audit, Snyk, and Dependabot patterns.
Processing and analyzing Static Analysis Results Interchange Format (SARIF) files for aggregating security findings across multiple scanning tools.
by thetestingacademy
Teach agents to run Nuclei DAST and API security scans in CI, write templates, and gate builds on actionable findings.
Testing cookie and session management including secure flags, SameSite policy, session fixation, timeout behavior, and cross-domain cookie handling.
American Fuzzy Lop Plus Plus mutation-based fuzz testing for finding crashes, hangs, and security vulnerabilities in binary programs.
Security testing for OAuth2 implementations including authorization code flow, PKCE, token handling, redirect URI validation, and scope enforcement.
by openai
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations to produce actionable AppSec-grade threat models.
SSL/TLS configuration testing including certificate validation, cipher suite analysis, protocol version checks, and HSTS verification.
Automated web application security scanning using OWASP ZAP for finding XSS, SQL injection, CSRF, and other OWASP Top 10 vulnerabilities.
Role-based and attribute-based access control testing including permission matrices, privilege escalation prevention, and resource-level authorization.
Testing API rate limiting implementations including throttling behavior, burst handling, rate limit headers, and distributed rate limiting patterns.
Evaluate and red-team LLM applications with promptfoo, declarative YAML evals, assertions, model comparisons, and automated adversarial scans for prompt injection, jailbreaks, PII leaks, and unsafe outputs in CI.
Integration with Google OSS-Fuzz for continuous fuzzing of open-source projects with automated bug filing and regression tracking.
Automated detection and prevention of leaked secrets, API keys, passwords, and tokens in code using tools like gitleaks, trufflehog, and pre-commit hooks.
Coverage-guided fuzz testing using libFuzzer for C/C++ applications to find memory corruption, buffer overflows, and crash-inducing inputs.
Fuzz testing for Rust applications using cargo-fuzz and libFuzzer to discover memory safety issues, panics, and undefined behavior.
Testing PCI-DSS compliance for payment processing including encryption validation, access control testing, and secure data storage verification.
Expert-level CI/CD pipeline skill for test automation. Covers GitHub Actions, Jenkins, GitLab CI, Azure DevOps, parallel execution, matrix strategies, caching, artifact management, and deployment gates.