SKILL.md
Discovery Questions
Check .agents/qa-project-context.md first — if it exists, use it and skip anything already answered there (auth mechanism, compliance requirements, infrastructure). Then:
- Threat model: Has the team identified key assets, threat actors, and attack surfaces? If not, do a lightweight threat model before writing tests — it tells you which categories matter most.
- Auth mechanism: Session cookies, JWT, OAuth 2.0/OIDC, API keys, or MFA? Each has distinct negative-path tests (alg confusion, session fixation, state tampering).
- Compliance requirements: SOC 2, HIPAA, PCI DSS, GDPR? These mandate specific controls — map them with
compliance-testing; this skill only proves the controls behave. - Existing security tooling: Already running OSV-Scanner, Snyk, Dependabot, Semgrep, or ZAP? Check CI config for existing security stages before adding duplicates.
- API surface: REST, GraphQL, gRPC? Each protocol has specific injection and authorization vectors.
- Deployment model: Cloud (AWS/GCP/Azure), containers, serverless? Cloud-metadata endpoints are prime SSRF targets and misconfiguration is A02.