Agent skill · security · aj-geddes
security-testing
Identify security vulnerabilities through SAST, DAST, penetration testing, and dependency scanning. Use for security test, vulnerability scanning, OWASP, SQL injection, XSS, CSRF, and penetration testing.
Why this skill is useful
Provides specific implementation examples and best practices for security testing that the AI wouldn't reliably generate on its own.
What it needs
Requires zap installed locally. About 1k tokens when loaded. Last updated 2026-03-04. 307 stars on the source repository.
What this skill does
Security Testing Table of Contents Overview When to Use Quick Start Reference Guides Best Practices Overview Security testing identifies vulnerabilities, weaknesses, and threats in applications to ensure data protection, prevent unauthorized access, and maintain system integrity. It combines automated scanning (SAST, DAST) with manual penetration testing and code review. When to Use Testing for OWASP Top 10 vulnerabilities Scanning dependencies for known vulnerabilities Testing authentication and authorization Validating input sanitization Testing API security Checking for sensitive data exposure Validating security headers Testing session management Quick Start Minimal working example: Reference Guides Detailed implementations in the references/ directory: Guide Contents --- --- OWASP ZAP (DAST) OWASP ZAP (DAST) SQL Injection Testing SQL Injection Testing XSS Testing XSS Testing Authentication & Authorization Testing Authentication & Authorization Testing CSRF Protection Testing CSRF Protection Testing Dependency Vulnerability Scanning Dependency Vulnerability Scanning Security Headers Testing Security Headers Testing Secrets Detection Secrets Detection Best Practices ✅ DO Run security scans in CI/CD Test with real attack vectors Scan dependencies regularly Use security headers Implement rate limiting Validate and sanitize all input Use parameterized queries Test authentication/authorization thoroughly ❌ DON'T Store secrets in code Trust user input Expose detailed error messages Skip dependency updates Use default credentials Ignore security warnings Test only happy paths Commit sensitive data
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aj-geddes/security-testing