Agent skill · security · davila7
web-security-testing
Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.
Why this skill is useful
Adds a comprehensive workflow for testing web applications against OWASP Top 10 vulnerabilities, including specific actions and prompts that enhance security testing capabilities.
What it needs
About 2k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
Web Security Testing Workflow Overview Specialized workflow for testing web applications against OWASP Top 10 vulnerabilities including injection attacks, XSS, broken authentication, and access control issues. When to Use This Workflow Use this workflow when: Testing web application security Performing OWASP Top 10 assessment Conducting penetration tests Validating security controls Bug bounty hunting Workflow Phases Phase 1: Reconnaissance Skills to Invoke scanning-tools - Security scanning top-web-vulnerabilities - OWASP knowledge Actions 1. Map application surface 2. Identify technologies 3. Discover endpoints 4. Find subdomains 5. Document findings Copy-Paste Prompts Phase 2: Injection Testing Skills to Invoke sql-injection-testing - SQL injection sqlmap-database-pentesting - SQLMap Actions 1. Test SQL injection 2. Test NoSQL injection 3. Test command injection 4. Test LDAP injection 5. Document vulnerabilities Copy-Paste Prompts Phase 3: XSS Testing Skills to Invoke xss-html-injection - XSS testing html-injection-testing - HTML injection Actions 1. Test reflected XSS 2. Test stored XSS 3. Test DOM-based XSS 4. Test XSS filters 5. Document findings Copy-Paste Prompts Phase 4: Authentication Testing Skills to Invoke broken-authentication - Authentication testing Actions 1. Test credential stuffing 2. Test brute force protection 3. Test session management 4. Test password policies 5. Test MFA implementation Copy-Paste Prompts Phase 5: Access Control Testing Skills to Invoke idor-testing - IDOR testing file-path-traversal - Path traversal Actions 1. Test vertical privilege escalation 2. Test horizontal privilege escalation 3. Test IDOR vulnerabilities 4. Test directory traversal 5. Test unauthorized access Copy-Paste Prompts Phase 6: Security Headers Skills to Invoke api-security-best-practices - Security headers Actions 1. Check CSP implementation 2. Verify HSTS configuration 3. Test X-Frame-Options 4. Check X-Content-Type-Options 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/web-security-testing