Security & compliance

Compliance test patterns + readiness review: 8 skills (audit-trail-test-author, ccpa-test-patterns, compliance-evidence-generator, gdpr-test-patterns, hipaa-test-patterns, iso27001-test-patterns, pci-dss-control-test-author, soc2-evidence-collector) and 1 agent (compliance-readiness-reviewer). Covers regulated-industry test pattern catalogs.

DAST (dynamic application security testing): 6 skills (burp-headless, dast-scan-cadence-author, nightvision-dast, nuclei-dast, zap-authenticated-scans, zap-baseline) and 1 agent (dast-finding-triager). Sister to qa-sast for runtime vulnerabilities. Every scanner skill includes a mandatory False-positive triage section.

Structure-aware coverage-guided fuzzing: 3 reference skills (corpus-management-reference, sanitiser-integration-reference, crash-triage-reference) + 7 per-language fuzzer skills (libfuzzer-cpp, afl-plus-plus, go-native-fuzzing, cargo-fuzz-rust, atheris-python-fuzzing, jazzer-jvm-fuzzing, ossfuzz-integration) + 1 dispatcher skill (fuzz-tool-selector) + 2 agents (fuzz-target-author, fuzz-findings-critic). Distinct from qa-property-based (hypothesis-driven + shrinking) and qa-api-testing/schemathesis-fuzzing (API-layer); this is binary/system-level coverage-guided fuzzing.

Infrastructure-as-code testing + security policy: 6 skills (checkov-policy, helm-chart-tester, kics-policy, policy-as-code-runner, tfsec-policy, trivy-config) and 2 agents (iac-policy-checker, terraform-plan-reviewer).

Tenant-isolation testing for B2B SaaS: row-level security, cross-tenant leak detection, tenant-id propagation tracing, isolation-model references (silo / pool / bridge), and adversarial review of tenant-leak risk.

SAST (static application security testing): 7 skills (bandit-python, codeql-queries, eslint-security-rules, gosec-go, pmd-apex-rules, semgrep-rules, sonarqube-rules) and 1 agent (sast-finding-triager). Every scanner skill includes a mandatory False-positive triage section.

SBOM generation + container image scanning + vuln prioritization: 7 skills (cyclonedx-format, grype-scanning, sbom-diff, spdx-format, syft-generation, trivy-image, vex-author) and 1 agent (vuln-prioritizer). Required for US EO 14028 + EU CRA + FDA medical-device guidance.

SCA (software composition analysis): 8 skills (bundle-audit-ruby, cargo-audit-rust, dependabot-config, npm-pip-maven-audit, osv-scanner, reachability-analyzer, renovate-config, snyk-test) and 1 agent (sca-prioritizer).

Secrets scanning + rotation: 5 skills (gitleaks-scanning, kingfisher-scanning, secrets-baseline-manager, secrets-rotation-runner, trufflehog-scanning) and 1 agent (secrets-finding-triager). Covers detection AND rotation workflow (git-history scrub doesn't fix the leak).

PII detection, masking, and synthetic data generation for test environments: 8 skills (data-masking-techniques-reference, faker-synthetic-data, k-anonymity-verifier, pii-categories-reference, pii-masking-pipeline-builder, presidio-pii-detection, synthea-healthcare-data, test-data-governance-reference) and 1 agent (pii-leak-critic).