Agent skill · security · jeremylongshore
performing-security-testing
Test automate security vulnerability testing covering OWASP Top 10,
Why this skill is useful
Adds specific commands and patterns for automating security vulnerability testing that the AI wouldn't reliably generate on its own.
What it needs
Requires bandit, burp-suite, eslint, gitleaks, owasp-zap, semgrep, trivy, trufflehog installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Security Test Scanner Overview Automate security vulnerability detection covering OWASP Top 10 categories including SQL injection, XSS, CSRF, broken authentication, and sensitive data exposure. Combines static analysis (source code scanning with Semgrep, Bandit, ESLint security plugins) with dynamic testing patterns (input fuzzing, header validation, authentication bypass checks). Prerequisites Static analysis tools installed (Semgrep, ESLint with eslint-plugin-security, Bandit for Python, or SpotBugs for Java) Application running in a test environment (never scan production without explicit authorization) Written authorization to perform security testing on the target system npm audit, pip-audit, or trivy for dependency vulnerability scanning OWASP ZAP or Burp Suite for dynamic application security testing (optional) Instructions 1. Run dependency vulnerability scanning to identify known CVEs: Execute npm audit --json or pip-audit --format json or trivy fs .. Parse results and flag critical/high severity vulnerabilities. Check if vulnerable dependencies have available patches. 2. Perform static application security testing (SAST) on source code: Run Semgrep with OWASP rulesets: semgrep --config=p/owasp-top-ten. Execute language-specific scanners (Bandit for Python, ESLint security for JS). Scan for hardcoded secrets using gitleaks or trufflehog. 3. Analyze code for injection vulnerabilities: Search for string concatenation in SQL queries (use Grep for patterns like "SELECT." +). Identify unsanitized user input flowing into innerHTML, eval(), or exec(). Check for command injection via childprocess.exec() or os.system() with user input. 4. Validate authentication and authorization: Verify password hashing uses bcrypt, scrypt, or Argon2 (not MD5/SHA1). Check JWT token validation includes expiration, issuer, and audience claims. Ensure authorization checks exist on every protected endpoint. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/performing-security-testing