Compétences web-security-testing
🛡️

web-security-testing

Sûr

Test Web Apps for OWASP Top 10 Vulnerabilities

This workflow guides you through comprehensive security testing of web applications following the OWASP Top 10 methodology, from reconnaissance to reporting.

Prend en charge: Claude Codex Code(CC)
📊 71 Adéquat
1

Télécharger le ZIP du skill

2

Importer dans Claude

Allez dans Paramètres → Capacités → Skills → Importer un skill

3

Activez et commencez Ă  utiliser

Tester

Utilisation de "web-security-testing". Use @web-security-testing to test my web application at https://example.com

RĂ©sultat attendu:

  • Starting Phase 1: Reconnaissance
  • - Mapping application surface
  • - Identifying technologies used
  • - Discovering endpoints
  • - Finding subdomains
  • - Documenting initial findings
  • Ready to proceed to Phase 2: Injection Testing

Utilisation de "web-security-testing". We are in Phase 3 of @web-security-testing. Test for XSS in the search feature.

RĂ©sultat attendu:

  • Phase 3: XSS Testing
  • Testing vectors: reflected, stored, DOM-based
  • Test cases to execute:
  • - <script>alert(1)</script>
  • - <img src=x onerror=alert(1)>
  • - <svg onload=alert(1)>
  • Document all successful bypasses with proof of concept

Audit de sécurité

Sûr
v1 • 2/25/2026

Static analysis flagged 33 potential issues (31 external_commands, 2 weak cryptographic algorithms). After evaluation, all findings are FALSE POSITIVES. The external_commands detections are markdown code formatting (backticks) used for skill references like @scanning-tools, not actual shell execution. The cryptographic flags are false positives from keywords in the OWASP checklist. This is a legitimate security testing workflow with no malicious code.

1
Fichiers analysés
185
Lignes analysées
2
résultats
1
Total des audits

Problèmes à risque élevé (1)

SKILL.md:3SKILL.md:164
Weak Cryptographic Algorithm Detection
Scanner flagged lines 3 and 164 for weak cryptographic algorithm. Line 3 is YAML frontmatter description. Line 164 is OWASP category 'A04: Insecure Design'. No cryptographic code present.
Problèmes à risque moyen (1)
SKILL.md:31-32SKILL.md:42-44SKILL.md:49-50SKILL.md:60-66SKILL.md:71-72SKILL.md:82-84SKILL.md:89-101SKILL.md:106-107SKILL.md:117-123SKILL.md:128-140SKILL.md:145-157SKILL.md:182-183
External Commands Detection
Scanner flagged 31 instances of 'Ruby/shell backtick execution' at various lines. These are markdown inline code formatting (backticks) used for skill references like `@scanning-tools`, not shell commands.
Audité par: claude

Score de qualité

38
Architecture
100
Maintenabilité
85
Contenu
50
Communauté
90
Sécurité
83
Conformité aux spécifications

Ce que vous pouvez construire

Comprehensive Security Assessment

Conduct a full security audit of a web application following structured OWASP Top 10 methodology with detailed phase-by-phase testing.

Bug Bounty Reconnaissance

Use the workflow for bug bounty hunting to systematically test target applications for vulnerabilities in a structured manner.

Security Validation

Validate that security controls are properly implemented in a web application before production deployment.

Essayez ces prompts

Start Security Test 
Use @web-security-testing to test my web application for security vulnerabilities. Target: [URL]
Test for Injection 
We are in Phase 2 of @web-security-testing. Test for SQL injection on the login form at [URL] with parameter [param]
XSS Assessment 
Following Phase 3 of @web-security-testing, test for XSS vulnerabilities in the comment section at [URL]
Complete Security Report 
We have completed all phases of @web-security-testing. Generate a security report summarizing findings and remediation steps.

Bonnes pratiques

  • Always obtain proper authorization before testing any application
  • Follow the workflow phases in order for comprehensive coverage
  • Document all findings with proof of concept for each vulnerability
  • Invoke referenced skills for specialized testing in each phase

Éviter

  • Skipping phases - each phase builds on previous reconnaissance
  • Testing in production without authorization
  • Not documenting findings with reproduction steps
  • Ignoring low-severity findings without proper risk assessment

Foire aux questions

Does this skill execute actual exploits?
No. This is a workflow guidance skill that provides testing methodology and prompts. It does not execute exploits or run tools directly.
Do I need other skills to use this workflow?
Yes. This workflow references other skills like @scanning-tools, @sql-injection-testing, @xss-html-injection, and @broken-authentication for specific testing phases.
Is this suitable for production testing?
Only with proper written authorization. Always ensure you have explicit permission before testing any web application.
What OWASP categories are covered?
All OWASP Top 10 2021 categories are covered including injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting, insecure deserialization, using vulnerable components, and insufficient logging.
Can I customize this workflow?
Yes. The workflow phases can be adapted based on your target application and scope. Add or modify phases as needed for your assessment.
What output format should I use for reports?
Follow the reporting phase guidance to document vulnerabilities with severity, proof of concept, and remediation steps. Use industry standard formats.

Détails du développeur

Auteur

sickn33

Licence

MIT

DĂ©pĂ´t

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/web-security-testing

RĂ©f

main

Structure de fichiers

đź“„ SKILL.md