The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs adb (Android Debug Bridge) commands to automate interactions with Android emulators and devices, specifically for UI navigation (adb shell input tap) and simulating network latency for performance testing (adb shell tc).
[REMOTE_CODE_EXECUTION]: The instructions include JavaScript snippets for dynamic execution within the browser or via Node.js. These templates are used for legitimate testing purposes, such as capturing Largest Contentful Paint (LCP) metrics, emulating network conditions via the Chrome DevTools Protocol (CDP), and managing mobile WebView sessions.
[EXTERNAL_DOWNLOADS]: The skill integrates with external services like Firecrawl to fetch current security guidelines (OWASP/MASVS) and references public attack checklists to ensure comprehensive test coverage.
[DATA_EXPOSURE]: The skill performs deep analysis of local project files (e.g., package.json, Prisma schemas) and database logs to identify vulnerabilities. It features explicit guardrails to manage secrets by reference name only and requires test data to be prefixed for easy cleanup.
[PROMPT_INJECTION]: Although the skill uses adversarial language (e.g., "attack," "break," "red team"), these instructions are strictly confined to the scope of auditing a target application and do not attempt to override agent safety protocols or extract system instructions.
[SAFE]: The skill demonstrates a high security posture by mandating benign proof-of-concept payloads (e.g., modifying document.title instead of using alert()) and implementing a "Rules of Engagement" phase to prevent accidental data loss or unauthorized mutations.

test-red-team