Generated banner for Testing Handbook Generator
Generated logo for Testing Handbook Generator

Testing Handbook Generator

Trail of BitsOfficialPublished by Trail of Bits

  • Skill
  • Workflow
  • Agent tooling
  • CC-BY-SA-4.0
  • No issues found

From the author

Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the user names the testing handbook or appsec.guide. Not for answering security testing questions — the generated skills cover those.
— the description by Trail of Bits

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The testing-handbook-generator is a workflow-based skill designed to transform content from the Trail of Bits Testing Handbook into structured Claude Code skills. It follows a multi-phase process that includes handbook discovery, planning, two-pass content generation, and validation. The skill ensures that generated documentation adheres to specific templates based on the handbook section type, such as tools, fuzzers, techniques, or domains. It also manages cross-references between generated skills and updates repository documentation to maintain consistency.

What it does

  • Analyzes the Trail of Bits Testing Handbook to identify potential skills.
  • Generates structured SKILL.md files using predefined templates.
  • Executes a two-pass generation process to handle cross-references between skills.
  • Validates generated skills and their cross-references using automated scripts.
  • Updates the repository README and cross-reference graphs.
  • Supports regeneration of individual skills from specific handbook sections.

When to use it

  • When you need to create new security testing skills derived from the appsec.guide handbook.
  • When you need to refresh existing skills based on updates to the handbook content.
  • When you are performing bulk skill generation or maintenance within the plugin structure.
  • When a user explicitly references the testing handbook or appsec.guide.

Advantages

  • Ensures consistent structure across all generated security skills.
  • Automates the complex task of managing inter-skill dependencies.
  • Provides a clear workflow for validating and integrating new skills into the repository.
  • Reduces manual effort in maintaining documentation and cross-references.

Usage examples

“Generate skills from the testing handbook”
The agent initiates the discovery phase, scans the handbook, presents a generation plan for approval, and proceeds to create the skills.
“Create a skill for the libFuzzer section”
The agent reads the specific libFuzzer handbook section, applies the fuzzer-skill template, and generates the corresponding SKILL.md file.
“Regenerate the semgrep skill from the handbook”
The agent re-reads the relevant handbook section, overwrites the existing semgrep SKILL.md, and updates cross-references.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/trailofbits/testing-handbook-generator/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip testing-handbook-generator.zip -d .agents/skills

Documentation by Trail of Bits

Testing Handbook Skill Generator

Generate and maintain Claude Code skills from the Trail of Bits Testing Handbook.

When to Use

Invoke this skill when:

  • Creating new security testing skills from handbook content

  • User mentions "testing handbook", "appsec.guide", or asks about generating skills

  • Bulk skill generation or refresh is needed

Do NOT use for:

  • General security testing questions (use the generated skills)

  • Non-handbook skill creation

Handbook Location

The skill needs the Testing Handbook repository. See discovery.md for full details.

Quick reference: Check ./testing-handbook, ../testing-handbook, ~/testing-handbook → ask user → clone as last resort.

Repository: https://github.com/trailofbits/testing-handbook

Workflow Overview

Phase 0: Setup              Phase 1: Discovery
┌─────────────────┐        ┌─────────────────┐
│ Locate handbook │   →    │ Analyze handbook│
│ - Find or clone │        │ - Scan sections │
│ - Confirm path  │        │ - Classify types│
└─────────────────┘        └─────────────────┘
         ↓                          ↓
Phase 3: Generation        Phase 2: Planning
┌─────────────────┐        ┌─────────────────┐
│ TWO-PASS GEN    │   ←    │ Generate plan   │
│ Pass 1: Content │        │ - New skills    │
│ Pass 2: X-refs  │        │ - Updates       │
│ - Write to gen/ │        │ - Present user  │
└─────────────────┘        └─────────────────┘
         ↓
Phase 4: Testing           Phase 5: Finalize
┌─────────────────┐        ┌─────────────────┐
│ Validate skills │   →    │ Post-generation │
│ - Run validator │        │ - Update README │
│ - Test activation│       │ - Update X-refs │
│ - Fix issues    │        │ - Self-improve  │
└─────────────────┘        └─────────────────┘

Scope Restrictions

ONLY modify these locations:

  • plugins/testing-handbook-skills/skills/[skill-name]/* - Generated skills (as siblings to testing-handbook-generator)

  • plugins/testing-handbook-skills/skills/testing-handbook-generator/* - Self-improvement

  • Repository root README.md - Add generated skills to table

NEVER modify or analyze:

  • Other plugins (plugins/property-based-testing/, plugins/static-analysis/, etc.)

  • Other skills outside this plugin

Do not scan or pull into context any skills outside of testing-handbook-skills/. Generate skills based solely on handbook content and resources referenced from it.

Quick Reference

Section → Skill Type Mapping
Handbook SectionSkill TypeTemplate
/static-analysis/[tool]/Tool Skilltool-skill.md
/fuzzing/[lang]/[fuzzer]/Fuzzer Skillfuzzer-skill.md
/fuzzing/techniques/Technique Skilltechnique-skill.md
/crypto/[tool]/Domain Skilldomain-skill.md
/web/[tool]/Tool Skilltool-skill.md
Skill Candidate Signals
SignalIndicates
_index.md with bookCollapseSection: trueMajor tool/topic
Numbered files (00-, 10-, 20-)Structured content
techniques/ subsectionMethodology content
99-resources.md or 91-resources.mdHas external links
Exclusion Signals
SignalAction
draft: true in frontmatterSkip section
Empty directorySkip section
Template/placeholder fileSkip section
GUI-only tool (e.g., web/burp/)Skip section (Claude cannot operate GUI tools)

Decision Tree

Starting skill generation?

├─ Need to analyze handbook and build plan?
│  └─ Read: discovery.md
│     (Handbook analysis methodology, plan format)
│
├─ Spawning skill generation agents?
│  └─ Read: agent-prompt.md
│     (Full prompt template, variable reference, validation checklist)
│
├─ Generating a specific skill type?
│  └─ Read appropriate template:
│     ├─ Tool (Semgrep, CodeQL) → templates/tool-skill.md
│     ├─ Fuzzer (libFuzzer, AFL++) → templates/fuzzer-skill.md
│     ├─ Technique (harness, coverage) → templates/technique-skill.md
│     └─ Domain (crypto, web) → templates/domain-skill.md
│
├─ Validating generated skills?
│  └─ Run: scripts/validate-skills.py
│     Then read: testing.md for activation testing
│
├─ Finalizing after generation?
│  └─ See: Post-Generation Tasks below
│     (Update main README, update Skills Cross-Reference, self-improvement)
│
└─ Quick generation from specific section?
   └─ Use Quick Reference above, apply template directly

Two-Pass Generation (Phase 3)

Generation uses a two-pass approach to solve forward reference problems (skills referencing other skills that don't exist yet).

Pass 1: Content Generation (Parallel)

Generate all skills in parallel without the Related Skills section:

Pass 1 - Generating 5 skills in parallel:
├─ Agent 1: libfuzzer (fuzzer) → skills/libfuzzer/SKILL.md
├─ Agent 2: aflpp (fuzzer) → skills/aflpp/SKILL.md
├─ Agent 3: semgrep (tool) → skills/semgrep/SKILL.md
├─ Agent 4: harness-writing (technique) → skills/harness-writing/SKILL.md
└─ Agent 5: wycheproof (domain) → skills/wycheproof/SKILL.md

Each agent uses: pass=1 (content only, Related Skills left empty)

Pass 1 agents:

  • Generate all sections EXCEPT Related Skills

  • Leave a placeholder: ## Related Skills\n\n<!-- PASS2: populate after all skills exist -->

  • Output report includes references: DEFERRED

Pass 2: Cross-Reference Population (Sequential)

After all Pass 1 agents complete, run Pass 2 to populate Related Skills:

Pass 2 - Populating cross-references:
├─ Read all generated skill names from skills/*/SKILL.md
├─ For each skill, determine related skills based on:
│   ├─ related_sections from discovery (handbook structure)
│   ├─ Skill type relationships (fuzzers → techniques)
│   └─ Explicit mentions in content
└─ Update each SKILL.md's Related Skills section

Pass 2 process:

  1. Collect all generated skill names: ls -d skills/*/SKILL.md

  2. For each skill, identify related skills using the mapping from discovery

  3. Edit each SKILL.md to replace the placeholder with actual links

  4. Validate cross-references exist (no broken links)

Agent Prompt Template

See agent-prompt.md for the full prompt template with:

  • Variable substitution reference (including pass variable)

  • Pre-write validation checklist

  • Hugo shortcode conversion rules

  • Line count splitting rules

  • Error handling guidance

  • Output report format

Collecting Results

After Pass 1: Aggregate output reports, verify all skills generated. After Pass 2: Run validator to check cross-references.

Handling Agent Failures

If an agent fails or produces invalid output:

Failure TypeDetectionRecovery Action
Agent crashedNo output reportRe-run single agent with same inputs
Validation failedOutput report shows errorsCheck gaps/warnings, manually patch or re-run
Wrong skill typeContent doesn't match templateRe-run with corrected type parameter
Missing contentOutput report lists gapsAccept if minor, or provide additional related_sections
Pass 2 broken refValidator shows missing skillCheck if skill was skipped, update reference

Important: Do NOT re-run the entire parallel batch for a single agent failure. Fix individual failures independently.

Single-Skill Regeneration

To regenerate a single skill without re-running the entire batch:

# Regenerate single skill (Pass 1 - content only)
"Use testing-handbook-generator to regenerate the {skill-name} skill from section {section_path}"

# Example:
"Use testing-handbook-generator to regenerate the libfuzzer skill from section fuzzing/c-cpp/10-libfuzzer"

Regeneration workflow:

  1. Re-read the handbook section for fresh content

  2. Apply the appropriate template

  3. Write to skills/{skill-name}/SKILL.md (overwrites existing)

  4. Re-run Pass 2 for that skill only to update cross-references

  5. Run validator on the single skill: uv run scripts/validate-skills.py --skill {skill-name}

Output Location

Generated skills are written to:

skills/[skill-name]/SKILL.md

Each skill gets its own directory for potential supporting files (as siblings to testing-handbook-generator).

Quality Checklist

Before delivering generated skills:

  • [ ] All handbook sections analyzed (Phase 1)

  • [ ] Plan presented to user before generation (Phase 2)

  • [ ] Parallel agents launched - one per skill (Phase 3)

  • [ ] Templates applied correctly per skill type

  • [ ] Validator passes: uv run scripts/validate-skills.py

  • [ ] Activation testing passed - see testing.md

  • [ ] Main README.md updated with generated skills table

  • [ ] README.md Skills Cross-Reference graph updated

  • [ ] Self-improvement notes captured

  • [ ] User notified with summary

Post-Generation Tasks

1. Update Main README

After generating skills, update the repository's main README.md to list them.

Format: Add generated skills to the same "Available Plugins" table, directly after testing-handbook-skills. Use plain text testing-handbook-generator as the author (no link).

Example:

| Plugin | Description | Author |
|--------|-------------|--------|
| ... other plugins ... |
| [testing-handbook-skills](plugins/testing-handbook-skills/) | Meta-skill that generates skills from the Testing Handbook | Paweł Płatek |
| [libfuzzer](plugins/testing-handbook-skills/skills/libfuzzer/) | Coverage-guided fuzzing with libFuzzer for C/C++ | testing-handbook-generator |
| [aflpp](plugins/testing-handbook-skills/skills/aflpp/) | Multi-core fuzzing with AFL++ | testing-handbook-generator |
| [semgrep](plugins/testing-handbook-skills/skills/semgrep/) | Fast static analysis for finding bugs | testing-handbook-generator |
2. Update Skills Cross-Reference

After generating skills, update the README.md's Skills Cross-Reference section with the mermaid graph showing skill relationships.

Process:

  1. Read each generated skill's SKILL.md and extract its ## Related Skills section

  2. Build the mermaid graph with nodes grouped by skill type (Fuzzers, Techniques, Tools, Domain)

  3. Add edges based on the Related Skills relationships:

    • Solid arrows (-->) for primary technique dependencies

    • Dashed arrows (-.->) for alternative tool suggestions

  4. Replace the existing mermaid code block in README.md

Edge classification:

RelationshipArrow StyleExample
Fuzzer → Technique-->libfuzzer --> harness-writing
Tool → Tool (alternative)-.->semgrep -.-> codeql
Fuzzer → Fuzzer (alternative)-.->libfuzzer -.-> aflpp
Technique → Technique-->harness-writing --> coverage-analysis

Validation: After updating, run validate-skills.py to verify all referenced skills exist.

3. Self-Improvement

After each generation run, reflect on what could improve future runs.

Capture improvements to:

  • Templates (missing sections, better structure)

  • Discovery logic (missed patterns, false positives)

  • Content extraction (shortcodes not handled, formatting issues)

Update process:

  1. Note issues encountered during generation

  2. Identify patterns that caused problems

  3. Update relevant files:

    • SKILL.md - Workflow, decision tree, quick reference updates

    • templates/*.md - Template improvements

    • discovery.md - Detection logic updates

    • testing.md - New validation checks

  4. Document the improvement in commit message

Example self-improvement:

Issue: libFuzzer skill missing sanitizer flags table
Fix: Updated templates/fuzzer-skill.md to include ## Compiler Flags section

Example Usage

Full Discovery and Generation
User: "Generate skills from the testing handbook"

1. Locate handbook (check common locations, ask user, or clone)
2. Read discovery.md for methodology
3. Scan handbook at {handbook_path}/content/docs/
4. Build candidate list with types
5. Present plan to user
6. On approval, generate each skill using appropriate template
7. Validate generated skills
8. Update main README.md with generated skills table
9. Update README.md Skills Cross-Reference graph from Related Skills sections
10. Self-improve: note any template/discovery issues for future runs
11. Report results
Single Section Generation
User: "Create a skill for the libFuzzer section"

1. Read /testing-handbook/content/docs/fuzzing/c-cpp/10-libfuzzer/
2. Identify type: Fuzzer Skill
3. Read templates/fuzzer-skill.md
4. Extract content, apply template
5. Write to skills/libfuzzer/SKILL.md
6. Validate and report

Tips

Do:

  • Always present plan before generating

  • Use appropriate template for skill type

  • Preserve code blocks exactly

  • Validate after generation

Don't:

  • Generate without user approval

  • Skip fetching non-video external resources (use WebFetch)

  • Fetch video URLs (YouTube, Vimeo - titles only)

  • Include handbook images directly

  • Skip validation step

  • Exceed 500 lines per SKILL.md


For first-time use: Start with discovery.md to understand the handbook analysis process.

For template reference: See templates/ directory for skill type templates.

For validation: See testing.md for quality assurance methodology.

Files

testing.md

Testing Strategy

Methodology for validating generated skills.

Prerequisites

Required tools for validation:

Python Dependencies

None to install: the scripts carry PEP 723 inline metadata, so uv run scripts/<name>.py resolves everything on first use.

Optional Tools
  • yq - YAML processor for manual checks: brew install yq (macOS)

Automated Validation

Use the validator script for comprehensive validation:

# Validate all generated skills
uv run scripts/validate-skills.py

# Validate specific skill
uv run scripts/validate-skills.py --skill libfuzzer

# Output JSON for CI integration
uv run scripts/validate-skills.py --json

# Verbose output with details
uv run scripts/validate-skills.py -v

The validator checks:

  • YAML frontmatter parsing and field validation (name, description)

  • Required sections presence by skill type

  • Line count limits (<500)

  • Hugo shortcode detection

  • Cross-reference validation (related skills exist)

  • Internal link resolution

Path Convention

All paths in this document are relative to testing-handbook-generator/:

  • Generated skills: ../[skill-name]/SKILL.md

  • Templates: ./templates/[type]-skill.md

Quick Validation Reference

Recommended: Use the automated validator:

uv run scripts/validate-skills.py --skill [skill-name]

Manual checks (for debugging or when validator is unavailable):

CheckCommandPassFail
Line countwc -l SKILL.md< 500≥ 500
Hugo shortcodesgrep -cE '\{\{[<%]' SKILL.md0> 0
Escaped backticksgrep -cE '\\{3}' SKILL.md`0> 0
YAML validhead -50 SKILL.md | yq -e '.' 2>&1No outputError message
Name formatyq '.name' SKILL.mdlowercase-nameMixed case, spaces, or special chars
Description existsyq '.description' SKILL.mdNon-empty stringnull or empty
Required sectionsgrep -c '^## ' SKILL.md≥ 3< 3

One-Liner Validation

Recommended: Use the automated validator for all checks:

# Validate all skills at once
uv run scripts/validate-skills.py

# JSON output for CI pipelines
uv run scripts/validate-skills.py --json

Legacy shell commands (for environments without Python):

SKILL="../libfuzzer/SKILL.md" && \
  [ $(wc -l < "$SKILL") -lt 500 ] && \
  [ $(grep -cE '\{\{[<%]' "$SKILL") -eq 0 ] && \
  awk '/^---$/{if(++n==2)exit}n==1' "$SKILL" | yq -e '.' >/dev/null 2>&1 && \
  echo "✓ Valid: $SKILL" || echo "✗ Invalid: $SKILL"

Validity Checks

Run these checks on every generated skill before delivery.

1. YAML Frontmatter Validation

Check: Frontmatter parses without errors

# Set skill path (replace 'libfuzzer' with target skill name)
SKILL="../libfuzzer/SKILL.md"

# Extract and validate frontmatter (awk extracts content between first two ---)
awk '/^---$/{if(++n==2)exit}n==1' "$SKILL" | yq -e '.'

# Validate name field
NAME=$(yq '.name' "$SKILL")
echo "$NAME" | grep -qE '^[a-z0-9-]{1,64}$' && echo "Name: OK" || echo "Name: INVALID"

# Validate description length
DESC=$(yq '.description' "$SKILL")
[ ${#DESC} -le 1024 ] && [ ${#DESC} -gt 0 ] && echo "Description: OK" || echo "Description: INVALID"

Required fields:

FieldRequirementValidation
namePresent, lowercase, max 64 charsPattern: ^[a-z0-9-]{1,64}$
typeRecommended, one of: tool, fuzzer, technique, domainDetermines required sections
descriptionPresent, non-empty, max 1024 charsLength: 1-1024 chars

Validation rules:

  • No XML/HTML tags in name or description (pattern: <[^>]+>)

  • No reserved words ("anthropic", "claude") in name

  • type field ensures correct section validation (if missing, type is inferred from content)

  • Description leads with what the skill does for the reader, not a definition of the tool, names the concrete commands, flags, and API symbols it covers, and closes with two or more situations in the words a user would type. "Coverage-guided fuzzer built into LLVM. Use for fuzzing C/C++ code" has a what and a when and still routes to nothing — see "Description quality" in agent-prompt.md for the bar.

  • No Hugo shortcodes in frontmatter (pattern: \{\{[<%])

Trigger phrase validation:

The description MUST include a trigger phrase ("Use when" or "Use for"):

# Check for trigger phrase in description
DESC=$(yq '.description' "$SKILL")
echo "$DESC" | grep -qE 'Use when|Use for' && echo "Trigger: OK" || echo "Trigger: MISSING"
2. Required Sections

Check: Skill contains essential sections

SectionRequiredPurpose
# TitleYesMain heading
## When to UseYesTrigger conditions
## Quick Reference or ## Quick StartYesFast access to key info
Core workflow/content sectionsYesMain skill content
## ResourcesIf handbook has resourcesExternal links

Template-specific required sections:

Skill TypeRequired Sections
ToolWhen to Use, Quick Reference, Installation, Core Workflow
FuzzerWhen to Use, Quick Start, Writing a Harness, Related Skills
TechniqueWhen to Apply, Quick Reference, Tool-Specific Guidance, Related Skills
DomainBackground, Quick Reference, Testing Workflow, Related Skills

Section validation command:

# Validate required sections for a tool skill
SKILL="../semgrep/SKILL.md"
REQUIRED=("When to Use" "Quick Reference" "Installation" "Core Workflow")

for section in "${REQUIRED[@]}"; do
  grep -q "^## $section" "$SKILL" && echo "✓ $section" || echo "✗ Missing: $section"
done

Related Skills validation:

For Fuzzer, Technique, and Domain skills, verify that the Related Skills section exists and references valid skills:

# Check Related Skills section exists
grep -q "^## Related Skills" "$SKILL" || echo "✗ Missing: Related Skills section"

# Extract skill references and check they exist
grep -oE '\*\*[a-z0-9-]+\*\*' "$SKILL" | tr -d '*' | sort -u | while read ref; do
  [ -d "../$ref" ] && echo "✓ $ref exists" || echo "⚠ $ref not found (may be planned)"
done
3. Line Count

Check: SKILL.md under 500 lines

wc -l ../libfuzzer/SKILL.md  # Replace 'libfuzzer' with target skill
# Should be < 500

If over 500 lines:

  • Split into supporting files

  • Keep SKILL.md as overview with decision tree

  • Reference supporting files with relative links

4. Internal Reference Resolution

Check: All internal links resolve

SKILL="../libfuzzer/SKILL.md"  # Replace 'libfuzzer' with target skill
SKILL_DIR=$(dirname "$SKILL")

# Find markdown links and verify they exist
grep -oE '\[.+\]\(([^)]+)\)' "$SKILL" | grep -oE '\([^)]+\)' | tr -d '()' | while read link; do
  # Skip external URLs
  [[ "$link" =~ ^https?:// ]] && continue
  # Check if file exists
  [ -f "$SKILL_DIR/$link" ] && echo "✓ $link" || echo "✗ $link (not found)"
done

Common issues:

IssueFix
Link to non-existent fileCreate file or remove link
Broken anchorUpdate anchor or content
Absolute path usedConvert to relative path
5. Code Block Preservation

Check: Code blocks preserved from handbook

Compare code blocks in generated skill vs source handbook section:

  • Indentation preserved

  • Language specifier present

  • No truncation

6. Hugo Shortcode Removal

Check: No Hugo shortcodes remain

# Should return nothing (exit code 1 = pass, exit code 0 = shortcodes found)
grep -E '\{\{[<%]' ../libfuzzer/SKILL.md  # Replace 'libfuzzer' with target skill

Shortcodes to remove:

  • {{< hint >}}...{{< /hint >}}

  • {{< tabs >}}...{{< /tabs >}}

  • {{< customFigure >}}

  • {{% relref "..." %}}

Activation Testing

Verify Claude activates the skill correctly.

Test 1: Direct Invocation

Prompt: "Use the [skill-name] skill"

Expected:

  • Claude loads SKILL.md

  • Claude references skill content

  • Claude follows skill workflow

Test 2: Implicit Trigger

Sample prompts by skill type:

Skill TypeTest Prompt
Tool (semgrep)"Scan this Python code for security issues"
Tool (codeql)"Set up CodeQL for my Java project"
Fuzzer (libfuzzer)"Help me fuzz this C function"
Fuzzer (aflpp)"Set up AFL++ for multi-core fuzzing"
Technique (harness)"Write a fuzzing harness for this parser"
Technique (coverage)"Analyze coverage of my fuzzing campaign"
Domain (wycheproof)"Test my ECDSA implementation"
Domain (constant-time)"Check if this crypto code has timing leaks"

Expected:

  • Skill description matches prompt intent

  • Claude selects this skill over alternatives

  • Claude uses skill content appropriately

Test 3: Decision Tree Navigation

Test: Claude navigates to supporting files correctly

Prompts:

  1. General query → Should use SKILL.md overview

  2. Specific topic → Should read appropriate supporting file

  3. Advanced topic → Should follow decision tree to detailed doc

Iteration Loop

┌─────────────────────────────────────────────────────┐
│                    Generate Skill                    │
└─────────────────────────────────────────────────────┘
                         │
                         ▼
┌─────────────────────────────────────────────────────┐
│         Run Validator Script                         │
│  uv run scripts/validate-skills.py --skill [name]   │
│                                                     │
│  Checks: YAML, sections, line count, shortcodes,   │
│          cross-refs, internal links                 │
└─────────────────────────────────────────────────────┘
                         │
              ┌──────────┴──────────┐
              │                     │
         All Pass              Failed
              │                     │
              ▼                     ▼
┌─────────────────────┐   ┌─────────────────────┐
│  Activation Test    │   │   Fix Issues        │
│  - Direct invoke    │   │   - Edit skill      │
│  - Implicit trigger │   │   - Re-run validator│
│  - Decision tree    │   └─────────────────────┘
└─────────────────────┘            │
              │                    │
              ▼                    │
┌─────────────────────┐            │
│     Pass?           │            │
└─────────────────────┘            │
         │                         │
    ┌────┴────┐                    │
   Yes        No                   │
    │         │                    │
    │         └────────────────────┘
    ▼
┌─────────────────────────────────────────────────────┐
│                  Mark Complete                       │
│  - Report success to user                           │
│  - List any warnings from validator                 │
└─────────────────────────────────────────────────────┘

Quality Checklist

Before delivering each generated skill:

## Skill: [name]

### Automated Validation
- [ ] Validator passes: `uv run scripts/validate-skills.py --skill [name]`
- [ ] No errors in output
- [ ] Warnings reviewed and addressed (or documented as acceptable)

### Content Quality (manual review)
- [ ] Description leads with the task, names concrete anchors, and gives two or more situations
- [ ] Every command, flag, file name, and API symbol the description advertises appears in the skill body
- [ ] When to Use section has clear triggers
- [ ] Quick Reference is actionable
- [ ] Code examples are complete and runnable
- [ ] Resources section has titles and URLs

### Activation Testing
- [ ] Direct invocation works
- [ ] Implicit trigger matches expected prompts
- [ ] Decision tree navigation correct

Bulk Generation Report

When generating multiple skills, use the validator JSON output:

# Generate JSON report
uv run scripts/validate-skills.py --json > validation-report.json

# Or view in terminal
uv run scripts/validate-skills.py

Example validator output:

==================================================
VALIDATION REPORT
==================================================
✓ libfuzzer
✓ semgrep ⚠
  WARNING: Line count 480 approaching limit of 500
✗ wycheproof
  ERROR: Missing required sections for domain skill: ['Background']

--------------------------------------------------
Total:    3
Passed:   2
Failed:   1
Warnings: 1
--------------------------------------------------
✗ 1 skill(s) failed validation

After validation, document results:

# Skill Generation Report

## Validator Results
- Total: X
- Passed: Y
- Failed: Z
- With warnings: W

## Actions Needed

### Failed Skills
1. **wycheproof**: Add Background section

### Warnings
1. **semgrep**: Line count 480 - consider splitting

## Next Steps
- [ ] Fix failed skills
- [ ] Address warnings
- [ ] Run activation tests

Common Issues and Fixes

IssueCauseFix
YAML parse errorUnquoted description containing : or #Put the description on one double-quoted line
Missing sectionTemplate not fully populatedFill from handbook
Over 500 linesToo much detail in main fileSplit to supporting files
Broken referenceSupporting file not createdCreate file or remove link
Shortcode remainsIncomplete conversionApply shortcode stripping
Activation failsPoor descriptionImprove trigger keywords

Post-Generation Checklist

After all skills pass validation, complete the tasks in SKILL.md Post-Generation Tasks.

Summary of required actions:

  1. Update main README.md with generated skills table

  2. Capture self-improvement notes

Self-Improvement Framework

After each generation run, systematically review and improve the generator.

Review Questions
CategoryQuestionIf Yes, Update
Content extractionDid any handbook content not extract cleanly?discovery.md (section 3.2)
ShortcodesWere there shortcodes or formats not handled?discovery.md (section 3.2)
Manual fixesDid any skills require manual fixes after generation?Templates or agent prompt
DetectionAre there patterns in the handbook not detected?discovery.md (section 1.3)
ActivationDid activation testing reveal description issues?agent-prompt.md ("Description quality") and the templates
ValidationDid a bug slip through validation?testing.md (add new check)
Improvement Log Format

When making improvements, document them:

## Self-Improvement Log

### YYYY-MM-DD: {Brief title}

**Issue:** {What went wrong during generation}
**Example:** {Specific skill/section affected}
**Root cause:** {Why the current logic failed}
**Fix:** {What was changed}
**Files modified:**
- `{file1}`: {what changed}
- `{file2}`: {what changed}
**Verification:** {How to confirm the fix works}
Improvement Priority
PriorityCriteriaAction
P0 - CriticalGenerated skill is broken/unusableFix immediately, re-generate affected skills
P1 - HighContent missing or incorrectFix before next generation run
P2 - MediumSuboptimal but functionalAdd to backlog, fix when convenient
P3 - LowMinor formatting/style issuesOptional improvement

Requirements and compatibility

Written for: Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Names Claude Code tools, Needs Python

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Trail of Bits
Publisher
Trail of Bits (Official)
Source
trailofbits/skills · plugins/testing-handbook-skills/skills/testing-handbook-generator · commit e4dd0bb
Licence
Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Trail of Bits.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download testing-handbook-generator.zip