Test Authorized Web Apps with Strix
Web application reviews can miss vulnerabilities behind login and across tenant boundaries. This skill guides authorized Strix testing, evidence review, and repeat testing after fixes.
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Review the Skillstore skill "web-app-penetration-testing" from https://skillstore.io/skills/usestrix-web-app-penetration-testing.md and its manifest at https://skillstore.io/api/skills/usestrix-web-app-penetration-testing/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Usando "web-app-penetration-testing". Prepare a staging test with two tenants, no billing access, and a budget of 20.
Resultado esperado:
Usando "web-app-penetration-testing". The scan returned exit code 0. Can I report that the application is secure?
Resultado esperado:
All 13 static findings are false positives: Markdown backticks and contextual URLs do not demonstrate unsafe shell execution or unauthorized network activity. The workflow explicitly requires authorization and warns that exploit testing modifies data. A separate medium-severity finding covers credentials placed in command-line arguments; no evidence of prompt injection or intentional data exfiltration was found.
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/usestrix-web-app-penetration-testing?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/usestrix-web-app-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/usestrix-web-app-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/usestrix-web-app-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>usestrix. (2026). web-app-penetration-testing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1@techreport{usestrix-usestrix-web-app-penetration-testing-2026,
author = {usestrix},
title = {web-app-penetration-testing security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1},
note = {Author version unspecified}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "web-app-penetration-testing security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "usestrix"
date-released: "2026-10-25"
url: "https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1"
identifiers:
- type: other
value: "skillstore:usestrix-web-app-penetration-testing:audit:1"
description: "Skillstore immutable audit report identifier"
Plan an authorized staging scan with excluded billing paths, disposable accounts, and a fixed spending limit.
Use two seeded accounts to investigate cross-account access and review reproducible evidence.
Review previous findings and repeat testing against the same authorized environment after a patch.
Help me scope an authorized Strix test for my staging application. Ask about ownership, excluded paths, test accounts, and budget before running anything.
Prepare a Strix scan for [authorized staging URL] with a [budget] limit. Exclude billing and email actions. Keep credentials out of command arguments.
Plan authorized access-control testing for two seeded tenants at [staging URL]. Use disposable accounts and optionally [repository]. Confirm exclusions before execution.
Review my Strix report and run status. Separate validated findings from coverage gaps, prioritize fixes, and plan authorized retesting without destructive actions.
Autor
usestrixLicencia
Apache-2.0
Revisión de Skillstore
r1
Aviso de versión
El autor no declaró una versión.
Ref.
485a85c5d1f66a7a93601c16a0049fd9cb0c611a
Actualidad del mantenimiento
25/10/2026
Uso
0 descargas · 0 vistas
Estructura de archivos
📄 SKILL.md
Assess Applications Against the OWASP Top 10
Security assessments can miss categories or confuse incomplete coverage with a clean result. This skill guides Strix testing and evidence-based reporting against OWASP Top 10:2025.
Run Authorized Penetration Tests with Strix
Application security teams need reproducible testing with clear scope, costs, and evidence. This skill guides Strix setup, authorized scans, and interpretation of validated findings.
Probar controles de acceso IDOR
por sickn33
Las fallas IDOR exponen registros privados cuando las referencias a objetos carecen de comprobaciones de propiedad. Esta skill guía a evaluadores autorizados en el descubrimiento, la verificación, la generación de informes y la planificación de la remediación.
Ejecutar pruebas de seguridad web OWASP
por sickn33
Los equipos web necesitan una forma repetible de comprobar riesgos comunes de aplicaciones antes del lanzamiento. Esta habilidad organiza las pruebas OWASP en fases, prompts y pasos de generación de informes.
Audit Python Web Apps Before Release
por glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
Fortalecer las revisiones de seguridad de aplicaciones
por alirezarezvani
Las revisiones de seguridad a menudo carecen de listas de verificación coherentes y flujos de trabajo reutilizables. Esta skill proporciona estructuras base para revisiones de seguridad, orientación de referencia y scripts simples de informes para Claude, Codex y Claude Code.
Generar informes de evaluación de seguridad
por BytR-Ecosystems
Los hallazgos de seguridad son difíciles de presentar con claridad a ejecutivos y equipos técnicos. Esta skill crea informes DOCX estructurados con calificaciones de riesgo y orientación de remediación.
Revisar la seguridad de una aplicación web antes del lanzamiento
por sickn33
Los problemas de seguridad suelen aparecer cuando los equipos agregan autenticación, APIs, pagos, cargas de archivos o flujos de datos sensibles. Esta habilidad proporciona una lista de verificación enfocada y prompts de revisión para encontrar riesgos comunes en aplicaciones web antes del despliegue.