Security & compliance

Compliance test patterns + readiness review: 8 skills (audit-trail-test-author, ccpa-test-patterns, compliance-evidence-generator, gdpr-test-patterns, hipaa-test-patterns, iso27001-test-patterns, pci-dss-control-test-author, soc2-evidence-collector) and 1 agent (compliance-readiness-reviewer). Covers regulated-industry test pattern catalogs.

Structure-aware coverage-guided fuzzing: 3 reference skills (corpus-management-reference, sanitiser-integration-reference, crash-triage-reference) + 7 per-language fuzzer skills (libfuzzer-cpp, afl-plus-plus, go-native-fuzzing, cargo-fuzz-rust, atheris-python-fuzzing, jazzer-jvm-fuzzing, ossfuzz-integration) + 1 dispatcher skill (fuzz-tool-selector) + 2 agents (fuzz-target-author, fuzz-findings-critic). Distinct from qa-property-based (hypothesis-driven + shrinking) and qa-api-testing/schemathesis-fuzzing (API-layer); this is binary/system-level coverage-guided fuzzing.

Infrastructure-as-code testing + security policy: 4 skills (helm-chart-tester, policy-as-code-runner, checkov-policy, trivy-config - the tfsec successor, with the legacy tfsec workflow in its references) and 1 agent (terraform-plan-reviewer). Cross-scanner IaC finding triage is handled by security-finding-triager in the qa-security-scanning plugin.

Tenant-isolation testing for B2B SaaS: row-level security, cross-tenant leak detection, tenant-id propagation tracing, isolation-model references (silo / pool / bridge), and adversarial review of tenant-leak risk.

Unified security scanning across five domains - SAST (semgrep-rules, sonarqube-rules, codeql-queries, language-native-sast, multi-tool-finding-triage), DAST (zap-baseline, nuclei-dast), SCA (snyk-test, osv-scanner, dependabot-config, renovate-config, npm-pip-maven-audit, reachability-analyzer, cve-exploitability-triage), secrets (gitleaks-scanning, trufflehog-scanning, secrets-rotation-runner), and SBOM + container (syft-generation, sbom-formats, trivy-image, vex-author): 21 skills and 1 agent (security-finding-triager), the cross-domain adversarial unifier that gates multi-scanner output into one BLOCK / PASS verdict per domain. Every scanner skill includes a mandatory False-positive triage section.

PII detection, masking, and synthetic data generation for test environments: 8 skills (data-masking-techniques-reference, faker-synthetic-data, k-anonymity-verifier, pii-categories-reference, pii-masking-pipeline-builder, presidio-pii-detection, synthea-healthcare-data, test-data-governance-reference) and 1 agent (pii-leak-critic).