Test Authorized Web Apps with Strix
Web application reviews can miss vulnerabilities behind login and across tenant boundaries. This skill guides authorized Strix testing, evidence review, and repeat testing after fixes.
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
Review the Skillstore skill "web-app-penetration-testing" from https://skillstore.io/skills/usestrix-web-app-penetration-testing.md and its manifest at https://skillstore.io/api/skills/usestrix-web-app-penetration-testing/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
正在使用「web-app-penetration-testing」。 Prepare a staging test with two tenants, no billing access, and a budget of 20.
預期結果:
正在使用「web-app-penetration-testing」。 The scan returned exit code 0. Can I report that the application is secure?
預期結果:
All 13 static findings are false positives: Markdown backticks and contextual URLs do not demonstrate unsafe shell execution or unauthorized network activity. The workflow explicitly requires authorization and warns that exploit testing modifies data. A separate medium-severity finding covers credentials placed in command-line arguments; no evidence of prompt injection or intentional data exfiltration was found.
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/usestrix-web-app-penetration-testing?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/usestrix-web-app-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/usestrix-web-app-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/usestrix-web-app-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>usestrix. (2026). web-app-penetration-testing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1@techreport{usestrix-usestrix-web-app-penetration-testing-2026,
author = {usestrix},
title = {web-app-penetration-testing security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1},
note = {Author version unspecified}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "web-app-penetration-testing security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "usestrix"
date-released: "2026-10-25"
url: "https://skillstore.io/skills/usestrix-web-app-penetration-testing/audits/1"
identifiers:
- type: other
value: "skillstore:usestrix-web-app-penetration-testing:audit:1"
description: "Skillstore immutable audit report identifier"
Plan an authorized staging scan with excluded billing paths, disposable accounts, and a fixed spending limit.
Use two seeded accounts to investigate cross-account access and review reproducible evidence.
Review previous findings and repeat testing against the same authorized environment after a patch.
Help me scope an authorized Strix test for my staging application. Ask about ownership, excluded paths, test accounts, and budget before running anything.
Prepare a Strix scan for [authorized staging URL] with a [budget] limit. Exclude billing and email actions. Keep credentials out of command arguments.
Plan authorized access-control testing for two seeded tenants at [staging URL]. Use disposable accounts and optionally [repository]. Confirm exclusions before execution.
Review my Strix report and run status. Separate validated findings from coverage gaps, prioritize fixes, and plan authorized retesting without destructive actions.
作者
usestrix授權
Apache-2.0
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
485a85c5d1f66a7a93601c16a0049fd9cb0c611a
維護新鮮度
2026/10/25
使用量
0 次下載 · 0 次瀏覽
檔案結構
📄 SKILL.md
Assess Applications Against the OWASP Top 10
Security assessments can miss categories or confuse incomplete coverage with a clean result. This skill guides Strix testing and evidence-based reporting against OWASP Top 10:2025.
Run Authorized Penetration Tests with Strix
Application security teams need reproducible testing with clear scope, costs, and evidence. This skill guides Strix setup, authorized scans, and interpretation of validated findings.
測試 IDOR 存取控制
由 sickn33
當物件參照缺乏擁有權檢查時，IDOR 缺陷會暴露私人記錄。此技能會引導已授權的測試人員完成探索、驗證、報告與修復規劃。
執行 OWASP Web 安全測試
由 sickn33
Web 團隊需要一種可重複執行的方法，在發布前檢查常見的應用程式風險。此技能會將 OWASP 測試整理為階段、提示詞與報告步驟。
Audit Python Web Apps Before Release
由 glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
強化應用程式安全審查
由 alirezarezvani
安全審查通常缺乏一致的檢查清單和可重複使用的工作流程。此技能為 Claude、Codex 和 Claude Code 提供安全審查腳手架、參考指南和簡單的報告指令碼。
產生安全性評估報告
由 BytR-Ecosystems
安全性發現很難清楚呈現給高階主管和技術團隊。此技能會建立結構化 DOCX 報告，包含風險評級和修復指引。
發佈前審查 Web 應用程式安全性
由 sickn33
安全性問題經常在團隊新增身份驗證、API、付款、上傳或敏感資料流程時出現。此技能提供聚焦的檢查清單與審查提示，協助在部署前找出常見的 Web 應用程式風險。