Quality

Review Quality verifies implementation work before it is marked complete. It checks plan alignment, test coverage, and code simplification during the review-to-completion gate.

Second Opinion checks a finished draft’s claims against its cited evidence and flags fabrication, overreach, or invented IDs. Use it to sanity-check a report before sign-off or to review a document when you need an independent second read.

Test Authoring Framework separates test planning from implementation by deriving scenarios, oracle sources, and probes from acceptance criteria. Use it when filling test-plan or test-manifest notes, or when reviewing tests for implementation independence.

Api Spectral lints OpenAPI, AsyncAPI, and Arazzo specifications for security issues and design flaws. Use it to enforce API governance, OWASP API Security Top 10 checks, and custom rules in CI/CD pipelines.

Bandit Python SAST scans Python code for security vulnerabilities and anti-patterns using Bandit. Use it to find hardcoded secrets, injection risks, weak crypto, and other issues, then generate severity-based reports for remediation and CI/CD checks.

Container Vulnerability Scanning uses Grype to scan images, filesystems, and SBOMs for known vulnerabilities. Use it in CI/CD or security reviews to prioritize fixes with CVSS, EPSS, and CISA KEV data.

Ffuf is a fast web fuzzer for DAST tasks like directory enumeration, parameter fuzzing, and virtual host discovery. Use it to find hidden endpoints, test auth forms, and scan for exposed backup or sensitive files.

Hashcat Password Recovery supports authorized password auditing, forensic recovery, and security research on password hashes. Use it to identify hash types, run cracking attacks, and report password policy weaknesses.

Integrity Auditor audits papers for image misuse, numerical anomalies, and logical gaps, then writes a reviewable evidence report. Use it for PDFs, DOI or arXiv papers, or outputs from a local paper-writer run.

License Audit lists the open-source licenses of a project's dependencies and groups them by license family. It flags GPL or AGPL dependencies when you need to assess copyleft risk before shipping.

License Audit checks the open-source licenses of direct project dependencies before release. It flags GPL or AGPL as blocked and unknown licenses as warnings.

Metasploit Penetration Testing provides structured workflows for authorized vulnerability validation, exploit development, and post-exploitation in controlled environments. Use it when testing defenses, confirming impact, or running scoped penetration tests.