Skills are how agents act.

Reads ambiguous user stories, Jira tickets, or PRDs. Extracts actors, contracts, side effects, and constraints into a normalized intent graph.

Breaks a normalized requirement into happy paths, edge cases, and negative paths. Anchors edge cases on real boundaries — timing, encoding, concurrency, exhaustion.

Synthesizes non-obvious edge cases — Unicode, off-by-one, race conditions, replay attacks. Uses a curated catalog of past production incidents as priors.

Renders scenarios as Cucumber-compliant Gherkin with realistic data. Tags scenarios with [EDGE] / [NEGATIVE] for downstream agents.

Converts Gherkin steps into Cucumber/TypeScript step definitions. Wires parameters, expression types, and shared world state automatically.

Inspects DOM (live or via spec) and emits typed Page Objects with stable selectors and high-level actions. Enforces single-responsibility per object.

Picks the most stable selector for a target element — role-based first, label-based next, test-id last. Avoids brittle CSS class chains.

When a locator fails in CI, proposes a replacement based on accessibility tree diff and test history. Cuts maintenance churn by ~35%.

Reads OpenAPI / GraphQL schemas and emits contract + integration tests. Handles auth, pagination, idempotency, and rate-limit assertions.

Synthesizes realistic test data — names, addresses, payment cards, medical records, account numbers — with deterministic seeds and PII safety.

Augments thin Gherkin Then-clauses with additional assertions: response codes, side-effects, audit log entries, downstream events.

Same Gherkin spec → Playwright, Cypress, WebdriverIO, or Selenium output. Lets teams adopt the squad without re-platforming existing automation.

Translates business-level load expectations (peak Black Friday traffic, end-of-month reporting) into k6/JMeter/Locust scripts with realistic think times.

Builds ramp-up, soak, spike, and chaos scenarios from a single SLO definition. Wires them to ARIA's reporting pipeline by default.

Auto-correlates load test runs with APM metrics (Datadog, New Relic, Grafana) so saturation signals — pool exhaustion, GC pauses — show up in the report.

Identifies the exact concurrency level where p99 latency, error rate, or throughput crosses defined thresholds. Outputs a verdict, not raw numbers.

Curated probes for the OWASP API + Web Top 10. Read-only and non-destructive — safe to run in shared environments and lower production tiers.

Generates targeted attack payloads for injection, deserialization, SSRF, prototype pollution. Backs off on first signal of damage to stay non-destructive.

For every confirmed finding, records the exact request, response, and timing. Output is replayable in seconds for engineering verification.

Drafts a code or config change for each finding. Specific to the framework, language, and proxy in use. No 'investigate further' filler.

Consumes outputs from TARA, EVAN, LEO, and SARA in a single pass. Reconciles competing signals and surfaces the few that leadership should act on.

Pulls sprint metadata — name, dates, team, release tag, prior trend data — directly from connected issue trackers via MCP.

Compares current sprint signals to the prior 4–6 sprints. Flags trajectory not just snapshot — three consecutive declines is treated as a leading indicator.

Produces specific, owner-implied recommendations with effort estimates and projected impact. Ties each one to its supporting evidence.

Renders the final report in three formats: 30-second exec brief, 5-minute manager read, full engineering deep-dive — without rewriting content.

Bidirectional Jira connector. TARA pulls stories from sprints; ARIA pushes findings, recommendations, and quality reports back as issues, comments, or sprint reviews.

Pulls existing test cases and execution history; pushes EVAN-generated tests and run results back as cases, runs, and milestone reports.

Pulls work items + repos; pushes test plans, suites, and runs. Handles ADO test points and outcome states with full bi-directional sync.

Reads PRs, issues, code search; opens PRs containing EVAN-generated automation, SARA remediation patches, and ARIA-recommended changes.

Reads PRDs and ACs from Confluence pages as TARA input. Publishes ARIA's quality reports back as Confluence pages with embedded charts.

Real-time notifications when SARA finds Critical issues, LEO breaches an SLO, or ARIA's trend detector flags a regression. Routed to the right channel by component.

Streams APM metrics into LEO during load runs. ARIA correlates production incidents with sprint changes for retrospective analysis.

Red-team test suite covering the OWASP LLM Top 10 — prompt injection (direct + indirect), jailbreaks, system-prompt extraction, guardrail bypass, tool-scope escalation, insecure output handling, model DoS. Generates attack variants automatically and scores severity.

Checks factual claims in model output against a grounded source — retrieved documents, API responses, supplied context. Flags fabricated facts, unsupported numbers, and invented citations. Scores grounding quality on a per-claim basis.

Verifies the model honors what the system prompt actually said — refused topics stay refused, required output format is produced, tool calls stay in scope, citation policy is enforced. Catches silent spec drift between prompt versions.

Runs counterfactual probes that vary protected attributes (race, gender, age, geography, disability, accent) while holding the underlying scenario constant. Surfaces demographic disparity in outcomes, recommendations, refusal rates, and tone.

Tests refusal accuracy on safety-critical prompts (self-harm, dangerous instructions, illegal activity, CSAM-adjacent), and scans normal outputs for toxic-language leakage even on benign prompts. Anchored on NIST AI RMF safety dimensions.

Provisions cross-browser, cross-device test runners on demand for EVAN's Playwright suites. Captures device-specific failure evidence for SARA.