security-testing-strategy
Installation
SKILL.md
When to Use
Use this skill when you need to select and integrate the right testing layers to make a codebase resilient against the inputs it encounters — including inputs an attacker controls.
Invoke it for:
- New services or modules that lack a security testing plan
- Systems that parse external input (files, network protocols, API requests) and have no fuzz testing in place
- Codebases where secure-code-review found vulnerability classes (injection, memory corruption, race conditions) that need automated test coverage to prevent regression
- CI/CD pipelines that run only unit tests — missing dynamic analysis, sanitizers, and static analysis
- Open source projects eligible for OSS-Fuzz integration
Start by reading the secure-code-review findings report. The anti-patterns found there drive testing priorities: SQL injection findings mean unit tests for parameterized query enforcement; memory corruption patterns mean AddressSanitizer integration; concurrent access patterns mean ThreadSanitizer.
Do not use this skill for threat modeling, access control design, or reviewing existing code for vulnerabilities — those are separate skills.