Compétences web-app-penetration-testing
📩

web-app-penetration-testing

RĂ©vision du contenu r1 Risque moyen ⚙ Commandes externes🌐 AccĂšs rĂ©seau

Test Authorized Web Apps with Strix

Web application reviews can miss vulnerabilities behind login and across tenant boundaries. This skill guides authorized Strix testing, evidence review, and repeat testing after fixes.

Prend en charge: Claude Codex Code(CC)
Maintain this Skill? Claim it 📊 70 AdĂ©quat

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent
Review the Skillstore skill "web-app-penetration-testing" from https://skillstore.io/skills/usestrix-web-app-penetration-testing.md and its manifest at https://skillstore.io/api/skills/usestrix-web-app-penetration-testing/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/usestrix-web-app-penetration-testing.md manifest signé GET /api/skills/usestrix-web-app-penetration-testing/manifest lockfile signé GET /api/skills/usestrix-web-app-penetration-testing/lockfile

Tester

Utilisation de « web-app-penetration-testing ». Prepare a staging test with two tenants, no billing access, and a budget of 20.

RĂ©sultat attendu:

  • Before execution: confirm explicit authorization and the staging target.
  • Scope: application and API paths; exclude billing, outbound email, and third-party identity providers.
  • Accounts: two disposable users in separate seeded tenants.
  • Controls: budget limit of 20; provide credentials through a restricted-permission instruction file.

Utilisation de « web-app-penetration-testing ». The scan returned exit code 0. Can I report that the application is secure?

RĂ©sultat attendu:

  • No validated vulnerabilities were reported within the analyzed scope.
  • Check run status, spending, and whether budget or turn limits ended the scan early.
  • Confirm authenticated coverage and excluded paths before describing the results.
  • Do not interpret exit code 0 as proof of complete coverage.

Audit de sécurité

Risque moyen
v1 ‱ 25/10/2026 Ouvrir le rapport versionnĂ©

All 13 static findings are false positives: Markdown backticks and contextual URLs do not demonstrate unsafe shell execution or unauthorized network activity. The workflow explicitly requires authorization and warns that exploit testing modifies data. A separate medium-severity finding covers credentials placed in command-line arguments; no evidence of prompt injection or intentional data exfiltration was found.

1
Fichiers analysés
55
Lignes analysées
0
ÉlĂ©ments Ă  examiner
0
Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Moyen
SKILL.md:30-31SKILL.md:36
Test Credentials Exposed Through Command-Line Arguments
The example embeds a test password in --instruction, and the notes recommend supplying credentials this way. Actual passwords can enter shell history, process listings, or command logs.
The command and prose explicitly place credentials in CLI arguments. Exposure depends on host permissions and logging; the documented password is only a placeholder.

Facteurs de risque

⚙ Commandes externes (9)
SKILL.md:14 SKILL.md:29-32 SKILL.md:32-36 SKILL.md:36 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40 SKILL.md:46 SKILL.md:48
🌐 AccĂšs rĂ©seau (4)
SKILL.md:7 SKILL.md:30 SKILL.md:38 SKILL.md:39
Audité par: codex
Partager et citer ce rapport

Partagez le rapport d’évaluation versionnĂ©, le badge neutre, la carte intĂ©grable et les citations. Skillstore prĂ©sente les preuves sans dĂ©cider si ce Skill est sĂ»r.

Ouvrir le rapport versionné
Évaluation de sĂ©curitĂ©

Copier le lien du rapport

https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/usestrix-web-app-penetration-testing/security.svg)](https://skillstore.io/skills/usestrix-web-app-penetration-testing?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/usestrix-web-app-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/usestrix-web-app-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/usestrix-web-app-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citations académiques (APA · BibTeX · CFF)

Citation APA

usestrix. (2026). web-app-penetration-testing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1

Citation BibTeX

@techreport{usestrix-usestrix-web-app-penetration-testing-2026, author = {usestrix}, title = {web-app-penetration-testing security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "web-app-penetration-testing security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "usestrix" date-released: "2026-10-25" url: "https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1" identifiers: - type: other value: "skillstore:usestrix-web-app-penetration-testing:audit:1" description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen
55
Architecture
85
Maintenabilité
87
Contenu
65
Communauté
91
Conformité aux spécifications

Ce que vous pouvez créer

Review a Staging Release

Plan an authorized staging scan with excluded billing paths, disposable accounts, and a fixed spending limit.

Check Tenant Isolation

Use two seeded accounts to investigate cross-account access and review reproducible evidence.

Verify a Reported Fix

Review previous findings and repeat testing against the same authorized environment after a patch.

Essayez ces prompts

Establish Testing Scope 
Help me scope an authorized Strix test for my staging application. Ask about ownership, excluded paths, test accounts, and budget before running anything.
Prepare a Staging Scan 
Prepare a Strix scan for [authorized staging URL] with a [budget] limit. Exclude billing and email actions. Keep credentials out of command arguments.
Investigate Tenant Boundaries 
Plan authorized access-control testing for two seeded tenants at [staging URL]. Use disposable accounts and optionally [repository]. Confirm exclusions before execution.
Review Evidence and Retest 
Review my Strix report and run status. Separate validated findings from coverage gaps, prioritize fixes, and plan authorized retesting without destructive actions.

Bonnes pratiques

  • Confirm written authorization, target ownership, exclusions, and a budget before execution.
  • Prefer staging with disposable accounts, seeded tenants, and protected credential files.
  • Review exploit evidence and run completion before reporting findings, then retest fixes within the approved scope.

Éviter

  • Testing third-party or production systems without explicit permission and agreed operational limits.
  • Embedding real passwords in command arguments, shared prompts, or committed instruction files.
  • Treating exit code 0, a limited scan, or an unverified patch as proof of security.

Foire aux questions

Does this skill include the Strix scanner?
No. It provides a web application workflow and refers to separate skills for installation and cloud operation.
Can I test an application I do not own?
Only with explicit authorization from the responsible owner and an agreed scope. The skill requires confirmation before testing.
Can it test a local development server?
The workflow describes Docker Desktop host access for a local server. Actual connectivity depends on your Strix and Docker configuration.
Why use two test accounts?
Accounts in separate seeded tenants help validate cross-account access and tenant-isolation issues that one account cannot demonstrate.
Does exit code 0 mean my application is secure?
No. It means no validated vulnerabilities were reported in the analyzed scope. Check completion status and coverage limits.
How should I provide test credentials?
Prefer disposable credentials in a restricted-permission instruction file. Avoid command-line secrets, shared logs, and version-controlled credential files.

Détails du développeur

Auteur

usestrix

Licence

Apache-2.0

RĂ©vision Skillstore

r1

Avis de version

L’auteur n’a dĂ©clarĂ© aucune version.

DĂ©pĂŽt

https://github.com/usestrix/strix/tree/200a501f15a24a4152f92897a6b72af238ee69ef/skills/web-app-penetration-testing

RĂ©f

485a85c5d1f66a7a93601c16a0049fd9cb0c611a

RĂ©cence de maintenance

25/10/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📄 SKILL.md

Autres compétences de usestrix

Tout afficher

Compétences associées

Tout afficher
📩

security-review

78

Examiner la sĂ©curitĂ© d’une application web avant la publication

par sickn33

Les problÚmes de sécurité apparaissent souvent lorsque les équipes ajoutent une authentification, des API, des paiements, des téléversements ou des flux de données sensibles. Cette compétence fournit une liste de contrÎle ciblée et des consignes de revue pour détecter les risques courants des applications web avant le

Sécurité et conformité Voir