Security48k · #4544

web-security-testing

Lets your agent check website security. It looks for common flaws that hackers could exploit.

What it does

This tool helps check the security of websites and web applications by looking for common weaknesses that hackers could exploit. It tests against the top 10 known security risks (OWASP Top 10).

When to use it

✓When you want to test a website's security.
✓When looking for common flaws in web applications.
✓To check if a website is protected against known attacks.

Example of what to ask your AI

“Check the security of this website against the top 10 vulnerabilities.”

Want more? Open the sections below.

How to use

The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.

Skill link

https://github.com/sickn33/agentic-awesome-skills/blob/main/plugins/agentic-awesome-skills-claude/skills/web-security-testing/SKILL.md

Ready-to-paste message

Use this skill to help me: https://github.com/sickn33/agentic-awesome-skills/blob/main/plugins/agentic-awesome-skills-claude/skills/web-security-testing/SKILL.md Read the SKILL.md file at that link and follow its instructions for my task.

View on GitHub ↗Raw file

How it works

The tool follows a step-by-step process: first, it investigates the website to understand its structure and technologies. Then, it tests for specific attack types like code injection and login flaws, and finally, documents the findings.

Installation

Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.

In the terminal (Claude Code, Codex, Cursor), in your project folder:

npx skills add sickn33/agentic-awesome-skills --skill web-security-testing

Or download just the file:

curl -L https://raw.githubusercontent.com/sickn33/agentic-awesome-skills/main/plugins/agentic-awesome-skills-claude/skills/web-security-testing/SKILL.md -o SKILL.md

Technical content (original SKILL.md)

Original text by the author, straight from GitHub.

Web Security Testing Workflow

Overview

Specialized workflow for testing web applications against OWASP Top 10 vulnerabilities including injection attacks, XSS, broken authentication, and access control issues.

When to Use This Workflow

Use this workflow when:

Testing web application security
Performing OWASP Top 10 assessment
Conducting penetration tests
Validating security controls
Bug bounty hunting

Workflow Phases

Phase 1: Reconnaissance

Skills to Invoke

scanning-tools - Security scanning
top-web-vulnerabilities - OWASP knowledge

Actions

Map application surface
Identify technologies
Discover endpoints
Find subdomains
Document findings

Copy-Paste Prompts

Use @scanning-tools to perform web application reconnaissance

Phase 2: Injection Testing

Skills to Invoke

sql-injection-testing - SQL injection
sqlmap-database-pentesting - SQLMap

Actions

Test SQL injection
Test NoSQL injection
Test command injection
Test LDAP injection
Document vulnerabilities

Copy-Paste Prompts

Use @sql-injection-testing to test for SQL injection

Use @sqlmap-database-pentesting to automate SQL injection testing

Phase 3: XSS Testing

Skills to Invoke

xss-html-injection - XSS testing
html-injection-testing - HTML injection

Actions

Test reflected XSS
Test stored XSS
Test DOM-based XSS
Test XSS filters
Document findings

Copy-Paste Prompts

Use @xss-html-injection to test for cross-site scripting

Phase 4: Authentication Testing

Skills to Invoke

broken-authentication - Authentication testing

Actions

Test credential stuffing
Test brute force protection
Test session management
Test password policies
Test MFA implementation

Copy-Paste Prompts

Use @broken-authentication to test authentication security

Phase 5: Access Control Testing

Skills to Invoke

idor-testing - IDOR testing
file-path-traversal - Path traversal

Actions

Test vertical privilege escalation
Test horizontal privilege escalation
Test IDOR vulnerabilities
Test directory traversal
Test unauthorized access

Copy-Paste Prompts

Use @idor-testing to test for insecure direct object references

Use @file-path-traversal to test for path traversal

Phase 6: Security Headers

Skills to Invoke

api-security-best-practices - Security headers

Actions

Check CSP implementation
Verify HSTS configuration
Test X-Frame-Options
Check X-Content-Type-Options
Verify referrer policy

Copy-Paste Prompts

Use @api-security-best-practices to audit security headers

Phase 7: Reporting

Skills to Invoke

reporting-standards - Security reporting

Actions

Document vulnerabilities
Assess risk levels
Provide remediation
Create proof of concept
Generate report

Copy-Paste Prompts

Use @reporting-standards to create security report

OWASP Top 10 Checklist

A01: Broken Access Control
A02: Cryptographic Failures
A03: Injection
A04: Insecure Design
A05: Security Misconfiguration
A06: Vulnerable Components
A07: Authentication Failures
A08: Software/Data Integrity
A09: Logging/Monitoring
A10: SSRF

Quality Gates

All OWASP Top 10 tested
Vulnerabilities documented
Proof of concepts captured
Remediation provided
Report generated

Related Workflow Bundles

security-audit - Security auditing
api-security-testing - API security
wordpress-security - WordPress security

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

FAQ

What is the OWASP Top 10?

It's a list of the 10 most critical security vulnerabilities for web applications, created by a non-profit organization called OWASP.

Does this replace a professional security test?

No, this tool is an aid and does not replace validation and review by security experts.

What are 'injections' and 'XSS'?

These are types of attacks. Injection tries to insert malicious commands, and XSS (Cross-Site Scripting) tries to run unwanted scripts in another user's browser.

Details

Original description by the author

Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.

repo: sickn33/agentic-awesome-skills

Popularity

GitHub stars: 48k
Ranking position: #4544
License: MIT
Updated: 10/15/2026

Is this skill useful?

Comments

More skills from this repository

Agents48k

00-andruia-consultant

Helps your agent start or improve AI projects. It analyzes code, suggests tools, and creates action plans in Spanish.

sickn33/agentic-awesome-skills

Misc48k

007

Lets your agent perform security audits and threat modeling. It's useful for protecting projects against attacks and vulnerabilities.

sickn33/agentic-awesome-skills

Agents48k

10-andruia-skill-smith

Helps your agent create or improve AI tools. It defines how tools work, writes documentation, and validates the structure.

sickn33/agentic-awesome-skills

Misc48k

20-andruia-niche-intelligence

Lets your agent create a summary about a specific industry. It's useful for understanding the context, rules, usage patterns, and risks of a project, using reliable sources.

sickn33/agentic-awesome-skills

Similar skills

Security280k

django-security

Helps your agent implement security practices in Django applications. It focuses on authentication, authorization, and prevention against common attacks, ensuring more secure code.

affaan-m/ECC

Security280k

laravel-security

Helps your agent secure Laravel applications against threats. Implements security practices for authentication, authorization, and common attack prevention.

affaan-m/ECC

Security280k

module-regression

Helps your agent manage changes in large projects. Ensures code changes in one part don't break other parts.

affaan-m/ECC