Security Assessment Suite

## Overview

Security Assessment Suite is a comprehensive security testing toolkit for web applications. It combines three specialized skills to cover the full spectrum of web security assessment — from code-level security review, to access control vulnerability testing, to SSH infrastructure penetration testing.

## Quick Start

1. Install the plugin: `npx skillstore add @security-assessment-suite`
2. Start with **security-review** to audit your authentication, user input handling, secrets management, and API endpoints
3. Run **IDOR Vulnerability Testing** to detect insecure direct object references and broken access control
4. Use **ssh-penetration-testing** to assess your SSH infrastructure security

## Key Skills

- **security-review** — Provides a comprehensive security checklist for authentication flows, user input handling, secrets/key management, API endpoint hardening, and payment or sensitive feature implementation. Use this whenever you are adding auth, handling user input, working with secrets, or creating API endpoints.

- **IDOR Vulnerability Testing** — Detects and exploits Insecure Direct Object Reference (IDOR) vulnerabilities. Covers enumeration of user IDs and object references, authorization bypass techniques, and broken access control testing. Use when you need to test for IDOR vulnerabilities or verify that access control is properly enforced across user boundaries.

- **ssh-penetration-testing** — Comprehensive SSH security assessment for authorized penetration testing. Includes SSH service enumeration, credential testing, vulnerability scanning, and tunneling techniques. Use for infrastructure-level security audits of SSH services.

## Tips

- Run **security-review** first on new features before deployment — it catches common security anti-patterns early
- Combine **IDOR Vulnerability Testing** with **security-review** for thorough access control validation
- Use **ssh-penetration-testing** only in authorized testing environments — always get written permission before testing
- Pair this plugin with monitoring/logging tools for a complete security posture assessment