스킬 web-app-penetration-testing

📦

web-app-penetration-testing

Name: web-app-penetration-testing
Author: usestrix

콘텐츠 리비전 r1 중간 위험 ⚙️ 외부 명령어🌐 네트워크 접근

Test Authorized Web Apps with Strix

Web application reviews can miss vulnerabilities behind login and across tenant boundaries. This skill guides authorized Strix testing, evidence review, and repeat testing after fixes.

지원: Claude Codex Code(CC)

📊 70 적절함

Maintain this Skill? Claim it 📊 70 적절함

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "web-app-penetration-testing" from https://skillstore.io/skills/usestrix-web-app-penetration-testing.md and its manifest at https://skillstore.io/api/skills/usestrix-web-app-penetration-testing/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/usestrix-web-app-penetration-testing.md 서명된 manifest GET /api/skills/usestrix-web-app-penetration-testing/manifest 서명된 lockfile GET /api/skills/usestrix-web-app-penetration-testing/lockfile

테스트해 보기

"web-app-penetration-testing" 사용 중입니다. Prepare a staging test with two tenants, no billing access, and a budget of 20.

예상 결과:

Before execution: confirm explicit authorization and the staging target.
Scope: application and API paths; exclude billing, outbound email, and third-party identity providers.
Accounts: two disposable users in separate seeded tenants.
Controls: budget limit of 20; provide credentials through a restricted-permission instruction file.

"web-app-penetration-testing" 사용 중입니다. The scan returned exit code 0. Can I report that the application is secure?

예상 결과:

No validated vulnerabilities were reported within the analyzed scope.
Check run status, spending, and whether budget or turn limits ended the scan early.
Confirm authenticated coverage and excluded paths before describing the results.
Do not interpret exit code 0 as proof of complete coverage.

보안 감사

중간 위험

v1 • 2026. 10. 25. 버전별 보고서 열기

All 13 static findings are false positives: Markdown backticks and contextual URLs do not demonstrate unsafe shell execution or unauthorized network activity. The workflow explicitly requires authorization and warns that exploit testing modifies data. A separate medium-severity finding covers credentials placed in command-line arguments; no evidence of prompt injection or intentional data exfiltration was found.

스캔된 파일

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (1)

중간

SKILL.md:30-31 SKILL.md:36

Test Credentials Exposed Through Command-Line Arguments

The example embeds a test password in --instruction, and the notes recommend supplying credentials this way. Actual passwords can enter shell history, process listings, or command logs.

The command and prose explicitly place credentials in CLI arguments. Exposure depends on host permissions and logging; the documented password is only a placeholder.

위험 요인

⚙️ 외부 명령어 (9)

SKILL.md:14 SKILL.md:29-32 SKILL.md:32-36 SKILL.md:36 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40 SKILL.md:46 SKILL.md:48

🌐 네트워크 접근 (4)

SKILL.md:7 SKILL.md:30 SKILL.md:38 SKILL.md:39

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/usestrix-web-app-penetration-testing/security.svg)](https://skillstore.io/skills/usestrix-web-app-penetration-testing?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/usestrix-web-app-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/usestrix-web-app-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/usestrix-web-app-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

usestrix. (2026). web-app-penetration-testing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1

BibTeX 인용

@techreport{usestrix-usestrix-web-app-penetration-testing-2026,
  author = {usestrix},
  title = {web-app-penetration-testing security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "web-app-penetration-testing security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "usestrix"
date-released: "2026-10-25"
url: "https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1"
identifiers:
  - type: other
    value: "skillstore:usestrix-web-app-penetration-testing:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Review a Staging Release

Plan an authorized staging scan with excluded billing paths, disposable accounts, and a fixed spending limit.

Check Tenant Isolation

Use two seeded accounts to investigate cross-account access and review reproducible evidence.

Verify a Reported Fix

Review previous findings and repeat testing against the same authorized environment after a patch.

이 프롬프트를 사용해 보세요

Establish Testing Scope

Help me scope an authorized Strix test for my staging application. Ask about ownership, excluded paths, test accounts, and budget before running anything.

Prepare a Staging Scan

Prepare a Strix scan for [authorized staging URL] with a [budget] limit. Exclude billing and email actions. Keep credentials out of command arguments.

Investigate Tenant Boundaries

Plan authorized access-control testing for two seeded tenants at [staging URL]. Use disposable accounts and optionally [repository]. Confirm exclusions before execution.

Review Evidence and Retest

Review my Strix report and run status. Separate validated findings from coverage gaps, prioritize fixes, and plan authorized retesting without destructive actions.

모범 사례

Confirm written authorization, target ownership, exclusions, and a budget before execution.
Prefer staging with disposable accounts, seeded tenants, and protected credential files.
Review exploit evidence and run completion before reporting findings, then retest fixes within the approved scope.

피하기

Testing third-party or production systems without explicit permission and agreed operational limits.
Embedding real passwords in command arguments, shared prompts, or committed instruction files.
Treating exit code 0, a limited scan, or an unverified patch as proof of security.

자주 묻는 질문

Does this skill include the Strix scanner?

No. It provides a web application workflow and refers to separate skills for installation and cloud operation.

Can I test an application I do not own?

Only with explicit authorization from the responsible owner and an agreed scope. The skill requires confirmation before testing.

Can it test a local development server?

The workflow describes Docker Desktop host access for a local server. Actual connectivity depends on your Strix and Docker configuration.

Why use two test accounts?

Accounts in separate seeded tenants help validate cross-account access and tenant-isolation issues that one account cannot demonstrate.

Does exit code 0 mean my application is secure?

No. It means no validated vulnerabilities were reported in the analyzed scope. Check completion status and coverage limits.

How should I provide test credentials?

Prefer disposable credentials in a restricted-permission instruction file. Avoid command-line secrets, shared logs, and version-controlled credential files.

개발자 세부 정보

작성자

usestrix

라이선스

Apache-2.0

Skillstore 리비전

버전 안내

작성자가 버전을 선언하지 않았습니다.

리포지토리

https://github.com/usestrix/strix/tree/200a501f15a24a4152f92897a6b72af238ee69ef/skills/web-app-penetration-testing

참조

485a85c5d1f66a7a93601c16a0049fd9cb0c611a

유지보수 최신성

2026. 10. 25.

사용량

0 다운로드 · 0 조회

파일 구조

📄 SKILL.md

usestrix의 다른 스킬

전체 보기

📦

릴리스 전 웹 앱 보안 검토

작성자 sickn33

팀이 인증, API, 결제, 업로드 또는 민감한 데이터 흐름을 추가할 때 보안 문제가 자주 발생합니다. 이 스킬은 배포 전에 일반적인 웹 애플리케이션 위험을 찾기 위한 집중 체크리스트와 검토 프롬프트를 제공합니다.

보안 및 컴플라이언스 보기