Testing Handbook Generator
Trail of BitsOfficialPublished by Trail of Bits
- Skill
- Workflow
- Agent tooling
- CC-BY-SA-4.0
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The testing-handbook-generator is a workflow-based skill designed to transform content from the Trail of Bits Testing Handbook into structured Claude Code skills. It follows a multi-phase process that includes handbook discovery, planning, two-pass content generation, and validation. The skill ensures that generated documentation adheres to specific templates based on the handbook section type, such as tools, fuzzers, techniques, or domains. It also manages cross-references between generated skills and updates repository documentation to maintain consistency.
What it does
- Analyzes the Trail of Bits Testing Handbook to identify potential skills.
- Generates structured SKILL.md files using predefined templates.
- Executes a two-pass generation process to handle cross-references between skills.
- Validates generated skills and their cross-references using automated scripts.
- Updates the repository README and cross-reference graphs.
- Supports regeneration of individual skills from specific handbook sections.
When to use it
- When you need to create new security testing skills derived from the appsec.guide handbook.
- When you need to refresh existing skills based on updates to the handbook content.
- When you are performing bulk skill generation or maintenance within the plugin structure.
- When a user explicitly references the testing handbook or appsec.guide.
Advantages
- Ensures consistent structure across all generated security skills.
- Automates the complex task of managing inter-skill dependencies.
- Provides a clear workflow for validating and integrating new skills into the repository.
- Reduces manual effort in maintaining documentation and cross-references.
Usage examples
- “Generate skills from the testing handbook”
- The agent initiates the discovery phase, scans the handbook, presents a generation plan for approval, and proceeds to create the skills.
- “Create a skill for the libFuzzer section”
- The agent reads the specific libFuzzer handbook section, applies the fuzzer-skill template, and generates the corresponding SKILL.md file.
- “Regenerate the semgrep skill from the handbook”
- The agent re-reads the relevant handbook section, overwrites the existing semgrep SKILL.md, and updates cross-references.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/trailofbits/testing-handbook-generator/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip testing-handbook-generator.zip -d .agents/skills
Documentation by Trail of Bits
Testing Handbook Skill Generator
Generate and maintain Claude Code skills from the Trail of Bits Testing Handbook.
When to Use
Invoke this skill when:
Creating new security testing skills from handbook content
User mentions "testing handbook", "appsec.guide", or asks about generating skills
Bulk skill generation or refresh is needed
Do NOT use for:
General security testing questions (use the generated skills)
Non-handbook skill creation
Handbook Location
The skill needs the Testing Handbook repository. See discovery.md for full details.
Quick reference: Check ./testing-handbook, ../testing-handbook, ~/testing-handbook → ask user → clone as last resort.
Repository: https://github.com/trailofbits/testing-handbook
Workflow Overview
Phase 0: Setup Phase 1: Discovery
┌─────────────────┐ ┌─────────────────┐
│ Locate handbook │ → │ Analyze handbook│
│ - Find or clone │ │ - Scan sections │
│ - Confirm path │ │ - Classify types│
└─────────────────┘ └─────────────────┘
↓ ↓
Phase 3: Generation Phase 2: Planning
┌─────────────────┐ ┌─────────────────┐
│ TWO-PASS GEN │ ← │ Generate plan │
│ Pass 1: Content │ │ - New skills │
│ Pass 2: X-refs │ │ - Updates │
│ - Write to gen/ │ │ - Present user │
└─────────────────┘ └─────────────────┘
↓
Phase 4: Testing Phase 5: Finalize
┌─────────────────┐ ┌─────────────────┐
│ Validate skills │ → │ Post-generation │
│ - Run validator │ │ - Update README │
│ - Test activation│ │ - Update X-refs │
│ - Fix issues │ │ - Self-improve │
└─────────────────┘ └─────────────────┘Scope Restrictions
ONLY modify these locations:
plugins/testing-handbook-skills/skills/[skill-name]/*- Generated skills (as siblings to testing-handbook-generator)plugins/testing-handbook-skills/skills/testing-handbook-generator/*- Self-improvementRepository root
README.md- Add generated skills to table
NEVER modify or analyze:
Other plugins (
plugins/property-based-testing/,plugins/static-analysis/, etc.)Other skills outside this plugin
Do not scan or pull into context any skills outside of testing-handbook-skills/. Generate skills based solely on handbook content and resources referenced from it.
Quick Reference
Section → Skill Type Mapping
| Handbook Section | Skill Type | Template |
|---|---|---|
/static-analysis/[tool]/ | Tool Skill | tool-skill.md |
/fuzzing/[lang]/[fuzzer]/ | Fuzzer Skill | fuzzer-skill.md |
/fuzzing/techniques/ | Technique Skill | technique-skill.md |
/crypto/[tool]/ | Domain Skill | domain-skill.md |
/web/[tool]/ | Tool Skill | tool-skill.md |
Skill Candidate Signals
| Signal | Indicates |
|---|---|
_index.md with bookCollapseSection: true | Major tool/topic |
| Numbered files (00-, 10-, 20-) | Structured content |
techniques/ subsection | Methodology content |
99-resources.md or 91-resources.md | Has external links |
Exclusion Signals
| Signal | Action |
|---|---|
draft: true in frontmatter | Skip section |
| Empty directory | Skip section |
| Template/placeholder file | Skip section |
GUI-only tool (e.g., web/burp/) | Skip section (Claude cannot operate GUI tools) |
Decision Tree
Starting skill generation?
├─ Need to analyze handbook and build plan?
│ └─ Read: discovery.md
│ (Handbook analysis methodology, plan format)
│
├─ Spawning skill generation agents?
│ └─ Read: agent-prompt.md
│ (Full prompt template, variable reference, validation checklist)
│
├─ Generating a specific skill type?
│ └─ Read appropriate template:
│ ├─ Tool (Semgrep, CodeQL) → templates/tool-skill.md
│ ├─ Fuzzer (libFuzzer, AFL++) → templates/fuzzer-skill.md
│ ├─ Technique (harness, coverage) → templates/technique-skill.md
│ └─ Domain (crypto, web) → templates/domain-skill.md
│
├─ Validating generated skills?
│ └─ Run: scripts/validate-skills.py
│ Then read: testing.md for activation testing
│
├─ Finalizing after generation?
│ └─ See: Post-Generation Tasks below
│ (Update main README, update Skills Cross-Reference, self-improvement)
│
└─ Quick generation from specific section?
└─ Use Quick Reference above, apply template directlyTwo-Pass Generation (Phase 3)
Generation uses a two-pass approach to solve forward reference problems (skills referencing other skills that don't exist yet).
Pass 1: Content Generation (Parallel)
Generate all skills in parallel without the Related Skills section:
Pass 1 - Generating 5 skills in parallel:
├─ Agent 1: libfuzzer (fuzzer) → skills/libfuzzer/SKILL.md
├─ Agent 2: aflpp (fuzzer) → skills/aflpp/SKILL.md
├─ Agent 3: semgrep (tool) → skills/semgrep/SKILL.md
├─ Agent 4: harness-writing (technique) → skills/harness-writing/SKILL.md
└─ Agent 5: wycheproof (domain) → skills/wycheproof/SKILL.md
Each agent uses: pass=1 (content only, Related Skills left empty)Pass 1 agents:
Generate all sections EXCEPT Related Skills
Leave a placeholder:
## Related Skills\n\n<!-- PASS2: populate after all skills exist -->Output report includes
references: DEFERRED
Pass 2: Cross-Reference Population (Sequential)
After all Pass 1 agents complete, run Pass 2 to populate Related Skills:
Pass 2 - Populating cross-references:
├─ Read all generated skill names from skills/*/SKILL.md
├─ For each skill, determine related skills based on:
│ ├─ related_sections from discovery (handbook structure)
│ ├─ Skill type relationships (fuzzers → techniques)
│ └─ Explicit mentions in content
└─ Update each SKILL.md's Related Skills sectionPass 2 process:
Collect all generated skill names:
ls -d skills/*/SKILL.mdFor each skill, identify related skills using the mapping from discovery
Edit each SKILL.md to replace the placeholder with actual links
Validate cross-references exist (no broken links)
Agent Prompt Template
See agent-prompt.md for the full prompt template with:
Variable substitution reference (including
passvariable)Pre-write validation checklist
Hugo shortcode conversion rules
Line count splitting rules
Error handling guidance
Output report format
Collecting Results
After Pass 1: Aggregate output reports, verify all skills generated. After Pass 2: Run validator to check cross-references.
Handling Agent Failures
If an agent fails or produces invalid output:
| Failure Type | Detection | Recovery Action |
|---|---|---|
| Agent crashed | No output report | Re-run single agent with same inputs |
| Validation failed | Output report shows errors | Check gaps/warnings, manually patch or re-run |
| Wrong skill type | Content doesn't match template | Re-run with corrected type parameter |
| Missing content | Output report lists gaps | Accept if minor, or provide additional related_sections |
| Pass 2 broken ref | Validator shows missing skill | Check if skill was skipped, update reference |
Important: Do NOT re-run the entire parallel batch for a single agent failure. Fix individual failures independently.
Single-Skill Regeneration
To regenerate a single skill without re-running the entire batch:
# Regenerate single skill (Pass 1 - content only)
"Use testing-handbook-generator to regenerate the {skill-name} skill from section {section_path}"
# Example:
"Use testing-handbook-generator to regenerate the libfuzzer skill from section fuzzing/c-cpp/10-libfuzzer"Regeneration workflow:
Re-read the handbook section for fresh content
Apply the appropriate template
Write to
skills/{skill-name}/SKILL.md(overwrites existing)Re-run Pass 2 for that skill only to update cross-references
Run validator on the single skill:
uv run scripts/validate-skills.py --skill {skill-name}
Output Location
Generated skills are written to:
skills/[skill-name]/SKILL.mdEach skill gets its own directory for potential supporting files (as siblings to testing-handbook-generator).
Quality Checklist
Before delivering generated skills:
[ ] All handbook sections analyzed (Phase 1)
[ ] Plan presented to user before generation (Phase 2)
[ ] Parallel agents launched - one per skill (Phase 3)
[ ] Templates applied correctly per skill type
[ ] Validator passes:
uv run scripts/validate-skills.py[ ] Activation testing passed - see testing.md
[ ] Main
README.mdupdated with generated skills table[ ]
README.mdSkills Cross-Reference graph updated[ ] Self-improvement notes captured
[ ] User notified with summary
Post-Generation Tasks
1. Update Main README
After generating skills, update the repository's main README.md to list them.
Format: Add generated skills to the same "Available Plugins" table, directly after testing-handbook-skills. Use plain text testing-handbook-generator as the author (no link).
Example:
| Plugin | Description | Author |
|--------|-------------|--------|
| ... other plugins ... |
| [testing-handbook-skills](plugins/testing-handbook-skills/) | Meta-skill that generates skills from the Testing Handbook | Paweł Płatek |
| [libfuzzer](plugins/testing-handbook-skills/skills/libfuzzer/) | Coverage-guided fuzzing with libFuzzer for C/C++ | testing-handbook-generator |
| [aflpp](plugins/testing-handbook-skills/skills/aflpp/) | Multi-core fuzzing with AFL++ | testing-handbook-generator |
| [semgrep](plugins/testing-handbook-skills/skills/semgrep/) | Fast static analysis for finding bugs | testing-handbook-generator |2. Update Skills Cross-Reference
After generating skills, update the README.md's Skills Cross-Reference section with the mermaid graph showing skill relationships.
Process:
Read each generated skill's
SKILL.mdand extract its## Related SkillssectionBuild the mermaid graph with nodes grouped by skill type (Fuzzers, Techniques, Tools, Domain)
Add edges based on the Related Skills relationships:
Solid arrows (
-->) for primary technique dependenciesDashed arrows (
-.->) for alternative tool suggestions
Replace the existing mermaid code block in README.md
Edge classification:
| Relationship | Arrow Style | Example |
|---|---|---|
| Fuzzer → Technique | --> | libfuzzer --> harness-writing |
| Tool → Tool (alternative) | -.-> | semgrep -.-> codeql |
| Fuzzer → Fuzzer (alternative) | -.-> | libfuzzer -.-> aflpp |
| Technique → Technique | --> | harness-writing --> coverage-analysis |
Validation: After updating, run validate-skills.py to verify all referenced skills exist.
3. Self-Improvement
After each generation run, reflect on what could improve future runs.
Capture improvements to:
Templates (missing sections, better structure)
Discovery logic (missed patterns, false positives)
Content extraction (shortcodes not handled, formatting issues)
Update process:
Note issues encountered during generation
Identify patterns that caused problems
Update relevant files:
SKILL.md- Workflow, decision tree, quick reference updatestemplates/*.md- Template improvementsdiscovery.md- Detection logic updatestesting.md- New validation checks
Document the improvement in commit message
Example self-improvement:
Issue: libFuzzer skill missing sanitizer flags table
Fix: Updated templates/fuzzer-skill.md to include ## Compiler Flags sectionExample Usage
Full Discovery and Generation
User: "Generate skills from the testing handbook"
1. Locate handbook (check common locations, ask user, or clone)
2. Read discovery.md for methodology
3. Scan handbook at {handbook_path}/content/docs/
4. Build candidate list with types
5. Present plan to user
6. On approval, generate each skill using appropriate template
7. Validate generated skills
8. Update main README.md with generated skills table
9. Update README.md Skills Cross-Reference graph from Related Skills sections
10. Self-improve: note any template/discovery issues for future runs
11. Report resultsSingle Section Generation
User: "Create a skill for the libFuzzer section"
1. Read /testing-handbook/content/docs/fuzzing/c-cpp/10-libfuzzer/
2. Identify type: Fuzzer Skill
3. Read templates/fuzzer-skill.md
4. Extract content, apply template
5. Write to skills/libfuzzer/SKILL.md
6. Validate and reportTips
Do:
Always present plan before generating
Use appropriate template for skill type
Preserve code blocks exactly
Validate after generation
Don't:
Generate without user approval
Skip fetching non-video external resources (use WebFetch)
Fetch video URLs (YouTube, Vimeo - titles only)
Include handbook images directly
Skip validation step
Exceed 500 lines per SKILL.md
For first-time use: Start with discovery.md to understand the handbook analysis process.
For template reference: See templates/ directory for skill type templates.
For validation: See testing.md for quality assurance methodology.
Files
- ATTRIBUTION.mdAdded by AutoGineer969 B
- LICENSELicence file added by AutoGineer19.7 KiB
- SKILL.md14.3 KiB
- agent-prompt.md11.2 KiB
- agents/openai.yaml256 B
- assets/trail-of-bits-mark.svg3.0 KiB
- discovery.md15.4 KiB
- templates/domain-skill.md16.6 KiB
- templates/fuzzer-skill.md11.1 KiB
- templates/technique-skill.md12.3 KiB
- templates/tool-skill.md9.2 KiB
- testing.md16.3 KiB
testing.md
Testing Strategy
Methodology for validating generated skills.
Prerequisites
Required tools for validation:
Python Dependencies
None to install: the scripts carry PEP 723 inline metadata, so uv run scripts/<name>.py
resolves everything on first use.
Optional Tools
yq- YAML processor for manual checks:brew install yq(macOS)
Automated Validation
Use the validator script for comprehensive validation:
# Validate all generated skills
uv run scripts/validate-skills.py
# Validate specific skill
uv run scripts/validate-skills.py --skill libfuzzer
# Output JSON for CI integration
uv run scripts/validate-skills.py --json
# Verbose output with details
uv run scripts/validate-skills.py -vThe validator checks:
YAML frontmatter parsing and field validation (name, description)
Required sections presence by skill type
Line count limits (<500)
Hugo shortcode detection
Cross-reference validation (related skills exist)
Internal link resolution
Path Convention
All paths in this document are relative to testing-handbook-generator/:
Generated skills:
../[skill-name]/SKILL.mdTemplates:
./templates/[type]-skill.md
Quick Validation Reference
Recommended: Use the automated validator:
uv run scripts/validate-skills.py --skill [skill-name]Manual checks (for debugging or when validator is unavailable):
| Check | Command | Pass | Fail |
|---|---|---|---|
| Line count | wc -l SKILL.md | < 500 | ≥ 500 |
| Hugo shortcodes | grep -cE '\{\{[<%]' SKILL.md | 0 | > 0 |
| Escaped backticks | grep -cE '\\{3}' SKILL.md` | 0 | > 0 |
| YAML valid | head -50 SKILL.md | yq -e '.' 2>&1 | No output | Error message |
| Name format | yq '.name' SKILL.md | lowercase-name | Mixed case, spaces, or special chars |
| Description exists | yq '.description' SKILL.md | Non-empty string | null or empty |
| Required sections | grep -c '^## ' SKILL.md | ≥ 3 | < 3 |
One-Liner Validation
Recommended: Use the automated validator for all checks:
# Validate all skills at once
uv run scripts/validate-skills.py
# JSON output for CI pipelines
uv run scripts/validate-skills.py --jsonLegacy shell commands (for environments without Python):
SKILL="../libfuzzer/SKILL.md" && \
[ $(wc -l < "$SKILL") -lt 500 ] && \
[ $(grep -cE '\{\{[<%]' "$SKILL") -eq 0 ] && \
awk '/^---$/{if(++n==2)exit}n==1' "$SKILL" | yq -e '.' >/dev/null 2>&1 && \
echo "✓ Valid: $SKILL" || echo "✗ Invalid: $SKILL"Validity Checks
Run these checks on every generated skill before delivery.
1. YAML Frontmatter Validation
Check: Frontmatter parses without errors
# Set skill path (replace 'libfuzzer' with target skill name)
SKILL="../libfuzzer/SKILL.md"
# Extract and validate frontmatter (awk extracts content between first two ---)
awk '/^---$/{if(++n==2)exit}n==1' "$SKILL" | yq -e '.'
# Validate name field
NAME=$(yq '.name' "$SKILL")
echo "$NAME" | grep -qE '^[a-z0-9-]{1,64}$' && echo "Name: OK" || echo "Name: INVALID"
# Validate description length
DESC=$(yq '.description' "$SKILL")
[ ${#DESC} -le 1024 ] && [ ${#DESC} -gt 0 ] && echo "Description: OK" || echo "Description: INVALID"Required fields:
| Field | Requirement | Validation |
|---|---|---|
name | Present, lowercase, max 64 chars | Pattern: ^[a-z0-9-]{1,64}$ |
type | Recommended, one of: tool, fuzzer, technique, domain | Determines required sections |
description | Present, non-empty, max 1024 chars | Length: 1-1024 chars |
Validation rules:
No XML/HTML tags in name or description (pattern:
<[^>]+>)No reserved words ("anthropic", "claude") in name
typefield ensures correct section validation (if missing, type is inferred from content)Description leads with what the skill does for the reader, not a definition of the tool, names the concrete commands, flags, and API symbols it covers, and closes with two or more situations in the words a user would type. "Coverage-guided fuzzer built into LLVM. Use for fuzzing C/C++ code" has a what and a when and still routes to nothing — see "Description quality" in
agent-prompt.mdfor the bar.No Hugo shortcodes in frontmatter (pattern:
\{\{[<%])
Trigger phrase validation:
The description MUST include a trigger phrase ("Use when" or "Use for"):
# Check for trigger phrase in description
DESC=$(yq '.description' "$SKILL")
echo "$DESC" | grep -qE 'Use when|Use for' && echo "Trigger: OK" || echo "Trigger: MISSING"2. Required Sections
Check: Skill contains essential sections
| Section | Required | Purpose |
|---|---|---|
# Title | Yes | Main heading |
## When to Use | Yes | Trigger conditions |
## Quick Reference or ## Quick Start | Yes | Fast access to key info |
| Core workflow/content sections | Yes | Main skill content |
## Resources | If handbook has resources | External links |
Template-specific required sections:
| Skill Type | Required Sections |
|---|---|
| Tool | When to Use, Quick Reference, Installation, Core Workflow |
| Fuzzer | When to Use, Quick Start, Writing a Harness, Related Skills |
| Technique | When to Apply, Quick Reference, Tool-Specific Guidance, Related Skills |
| Domain | Background, Quick Reference, Testing Workflow, Related Skills |
Section validation command:
# Validate required sections for a tool skill
SKILL="../semgrep/SKILL.md"
REQUIRED=("When to Use" "Quick Reference" "Installation" "Core Workflow")
for section in "${REQUIRED[@]}"; do
grep -q "^## $section" "$SKILL" && echo "✓ $section" || echo "✗ Missing: $section"
doneRelated Skills validation:
For Fuzzer, Technique, and Domain skills, verify that the Related Skills section exists and references valid skills:
# Check Related Skills section exists
grep -q "^## Related Skills" "$SKILL" || echo "✗ Missing: Related Skills section"
# Extract skill references and check they exist
grep -oE '\*\*[a-z0-9-]+\*\*' "$SKILL" | tr -d '*' | sort -u | while read ref; do
[ -d "../$ref" ] && echo "✓ $ref exists" || echo "⚠ $ref not found (may be planned)"
done3. Line Count
Check: SKILL.md under 500 lines
wc -l ../libfuzzer/SKILL.md # Replace 'libfuzzer' with target skill
# Should be < 500If over 500 lines:
Split into supporting files
Keep SKILL.md as overview with decision tree
Reference supporting files with relative links
4. Internal Reference Resolution
Check: All internal links resolve
SKILL="../libfuzzer/SKILL.md" # Replace 'libfuzzer' with target skill
SKILL_DIR=$(dirname "$SKILL")
# Find markdown links and verify they exist
grep -oE '\[.+\]\(([^)]+)\)' "$SKILL" | grep -oE '\([^)]+\)' | tr -d '()' | while read link; do
# Skip external URLs
[[ "$link" =~ ^https?:// ]] && continue
# Check if file exists
[ -f "$SKILL_DIR/$link" ] && echo "✓ $link" || echo "✗ $link (not found)"
doneCommon issues:
| Issue | Fix |
|---|---|
| Link to non-existent file | Create file or remove link |
| Broken anchor | Update anchor or content |
| Absolute path used | Convert to relative path |
5. Code Block Preservation
Check: Code blocks preserved from handbook
Compare code blocks in generated skill vs source handbook section:
Indentation preserved
Language specifier present
No truncation
6. Hugo Shortcode Removal
Check: No Hugo shortcodes remain
# Should return nothing (exit code 1 = pass, exit code 0 = shortcodes found)
grep -E '\{\{[<%]' ../libfuzzer/SKILL.md # Replace 'libfuzzer' with target skillShortcodes to remove:
{{< hint >}}...{{< /hint >}}{{< tabs >}}...{{< /tabs >}}{{< customFigure >}}{{% relref "..." %}}
Activation Testing
Verify Claude activates the skill correctly.
Test 1: Direct Invocation
Prompt: "Use the [skill-name] skill"
Expected:
Claude loads SKILL.md
Claude references skill content
Claude follows skill workflow
Test 2: Implicit Trigger
Sample prompts by skill type:
| Skill Type | Test Prompt |
|---|---|
| Tool (semgrep) | "Scan this Python code for security issues" |
| Tool (codeql) | "Set up CodeQL for my Java project" |
| Fuzzer (libfuzzer) | "Help me fuzz this C function" |
| Fuzzer (aflpp) | "Set up AFL++ for multi-core fuzzing" |
| Technique (harness) | "Write a fuzzing harness for this parser" |
| Technique (coverage) | "Analyze coverage of my fuzzing campaign" |
| Domain (wycheproof) | "Test my ECDSA implementation" |
| Domain (constant-time) | "Check if this crypto code has timing leaks" |
Expected:
Skill description matches prompt intent
Claude selects this skill over alternatives
Claude uses skill content appropriately
Test 3: Decision Tree Navigation
Test: Claude navigates to supporting files correctly
Prompts:
General query → Should use SKILL.md overview
Specific topic → Should read appropriate supporting file
Advanced topic → Should follow decision tree to detailed doc
Iteration Loop
┌─────────────────────────────────────────────────────┐
│ Generate Skill │
└─────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────┐
│ Run Validator Script │
│ uv run scripts/validate-skills.py --skill [name] │
│ │
│ Checks: YAML, sections, line count, shortcodes, │
│ cross-refs, internal links │
└─────────────────────────────────────────────────────┘
│
┌──────────┴──────────┐
│ │
All Pass Failed
│ │
▼ ▼
┌─────────────────────┐ ┌─────────────────────┐
│ Activation Test │ │ Fix Issues │
│ - Direct invoke │ │ - Edit skill │
│ - Implicit trigger │ │ - Re-run validator│
│ - Decision tree │ └─────────────────────┘
└─────────────────────┘ │
│ │
▼ │
┌─────────────────────┐ │
│ Pass? │ │
└─────────────────────┘ │
│ │
┌────┴────┐ │
Yes No │
│ │ │
│ └────────────────────┘
▼
┌─────────────────────────────────────────────────────┐
│ Mark Complete │
│ - Report success to user │
│ - List any warnings from validator │
└─────────────────────────────────────────────────────┘Quality Checklist
Before delivering each generated skill:
## Skill: [name]
### Automated Validation
- [ ] Validator passes: `uv run scripts/validate-skills.py --skill [name]`
- [ ] No errors in output
- [ ] Warnings reviewed and addressed (or documented as acceptable)
### Content Quality (manual review)
- [ ] Description leads with the task, names concrete anchors, and gives two or more situations
- [ ] Every command, flag, file name, and API symbol the description advertises appears in the skill body
- [ ] When to Use section has clear triggers
- [ ] Quick Reference is actionable
- [ ] Code examples are complete and runnable
- [ ] Resources section has titles and URLs
### Activation Testing
- [ ] Direct invocation works
- [ ] Implicit trigger matches expected prompts
- [ ] Decision tree navigation correctBulk Generation Report
When generating multiple skills, use the validator JSON output:
# Generate JSON report
uv run scripts/validate-skills.py --json > validation-report.json
# Or view in terminal
uv run scripts/validate-skills.pyExample validator output:
==================================================
VALIDATION REPORT
==================================================
✓ libfuzzer
✓ semgrep ⚠
WARNING: Line count 480 approaching limit of 500
✗ wycheproof
ERROR: Missing required sections for domain skill: ['Background']
--------------------------------------------------
Total: 3
Passed: 2
Failed: 1
Warnings: 1
--------------------------------------------------
✗ 1 skill(s) failed validationAfter validation, document results:
# Skill Generation Report
## Validator Results
- Total: X
- Passed: Y
- Failed: Z
- With warnings: W
## Actions Needed
### Failed Skills
1. **wycheproof**: Add Background section
### Warnings
1. **semgrep**: Line count 480 - consider splitting
## Next Steps
- [ ] Fix failed skills
- [ ] Address warnings
- [ ] Run activation testsCommon Issues and Fixes
| Issue | Cause | Fix |
|---|---|---|
| YAML parse error | Unquoted description containing : or # | Put the description on one double-quoted line |
| Missing section | Template not fully populated | Fill from handbook |
| Over 500 lines | Too much detail in main file | Split to supporting files |
| Broken reference | Supporting file not created | Create file or remove link |
| Shortcode remains | Incomplete conversion | Apply shortcode stripping |
| Activation fails | Poor description | Improve trigger keywords |
Post-Generation Checklist
After all skills pass validation, complete the tasks in SKILL.md Post-Generation Tasks.
Summary of required actions:
Update main
README.mdwith generated skills tableCapture self-improvement notes
Self-Improvement Framework
After each generation run, systematically review and improve the generator.
Review Questions
| Category | Question | If Yes, Update |
|---|---|---|
| Content extraction | Did any handbook content not extract cleanly? | discovery.md (section 3.2) |
| Shortcodes | Were there shortcodes or formats not handled? | discovery.md (section 3.2) |
| Manual fixes | Did any skills require manual fixes after generation? | Templates or agent prompt |
| Detection | Are there patterns in the handbook not detected? | discovery.md (section 1.3) |
| Activation | Did activation testing reveal description issues? | agent-prompt.md ("Description quality") and the templates |
| Validation | Did a bug slip through validation? | testing.md (add new check) |
Improvement Log Format
When making improvements, document them:
## Self-Improvement Log
### YYYY-MM-DD: {Brief title}
**Issue:** {What went wrong during generation}
**Example:** {Specific skill/section affected}
**Root cause:** {Why the current logic failed}
**Fix:** {What was changed}
**Files modified:**
- `{file1}`: {what changed}
- `{file2}`: {what changed}
**Verification:** {How to confirm the fix works}Improvement Priority
| Priority | Criteria | Action |
|---|---|---|
| P0 - Critical | Generated skill is broken/unusable | Fix immediately, re-generate affected skills |
| P1 - High | Content missing or incorrect | Fix before next generation run |
| P2 - Medium | Suboptimal but functional | Add to backlog, fix when convenient |
| P3 - Low | Minor formatting/style issues | Optional improvement |
Requirements and compatibility
Written for: Claude Code
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Names Claude Code tools, Needs Python
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Trail of Bits
- Publisher
- Trail of Bits (Official)
- Source
- trailofbits/skills · plugins/testing-handbook-skills/skills/testing-handbook-generator · commit e4dd0bb
- Licence
- Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Trail of Bits or Trail of Bits.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download testing-handbook-generator.zip