skills.rest
bilacchi
bilacchiCOMMUNITY
Explore all skills by this author →
GitHub

web-security-testing

Tests web applications against OWASP Top 10 vulnerabilities through a seven-phase assessment workflow.

Updated Jun 12, 2026
Search Tags:#sql injection#xss#owasp#vulnerability assessment#penetration testing#security audit#web security
One-click install
npx skills add https://github.com/bilacchi/agents-skills --skill web-security-testing-bilacchi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-security-testing
Source: https://github.com/bilacchi/agents-skills/tree/main/skills/web-security-testing
Command: npx skills add https://github.com/bilacchi/agents-skills --skill web-security-testing-bilacchi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web application security assessments require systematic coverage of many vulnerability classes, and ad-hoc testing often misses critical issues like injection flaws, broken access control, or missing security headers. This Skill provides a structured, phase-by-phase workflow for conducting OWASP Top 10 assessments so nothing is overlooked. ## Core Features & Use Cases - Phased Testing Workflow: Seven ordered phases covering reconnaissance, injection testing, XSS testing, authentication testing, access control testing, security headers, and reporting. - OWASP Top 10 Checklist: Built-in checklist covering all ten categories from broken access control to SSRF, plus quality gates for documentation and remediation. - Orchestrated Sub-Skills: Each phase invokes specialized testing skills such as sql-injection-testing, xss-html-injection, idor-testing, and reporting-standards with ready-to-use prompts. - Use Case: A penetration tester scoping an authorized engagement against a client's web app follows the phases to map the attack surface, test for SQL injection and XSS, verify authentication and access controls, audit security headers, and produce a final vulnerability report. ## Quick Start Use the web-security-testing workflow to perform an OWASP Top 10 assessment on my authorized test application and generate a vulnerability report.

Frequently Asked Questions about web-security-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a web application for OWASP Top 10 vulnerabilities?▼

Follow a phased workflow: reconnaissance to map the attack surface, then injection testing, XSS testing, authentication testing, access control testing, and security header audits. Document each finding and finish with a structured vulnerability report including remediation guidance.

What tools are used for SQL injection testing in web apps?▼

This workflow invokes dedicated SQL injection testing skills and SQLMap-based automation for database penetration testing. Manual payload testing covers SQL, NoSQL, command, and LDAP injection, while SQLMap automates detection and exploitation of confirmed injection points.

Does this workflow cover XSS and access control testing?▼

Yes, it includes dedicated phases for reflected, stored, and DOM-based XSS testing, plus access control checks for vertical and horizontal privilege escalation, IDOR, and path traversal. Each phase lists specific actions and invokes specialized testing skills.

When should I not use this web security testing workflow?▼

Do not use it against applications without explicit authorization, as penetration testing without permission is illegal. It also does not replace environment-specific validation or expert review, and you should stop and clarify if scope, permissions, or success criteria are missing.

What should a web security assessment report include?▼

A complete report documents each discovered vulnerability, assigns risk levels, provides proof-of-concept evidence, and includes remediation recommendations. The workflow's quality gates require all OWASP Top 10 categories tested and findings documented before report generation.

Related Skills

Explore More Software Engineering Skills→
lNwNllNwNl

recon-and-methodology

Guides reconnaissance, endpoint discovery, and vulnerability testing methodology for authorized web targets.

Community
Intermediate
jinyimeng01jinyimeng01
54

report-agent

Generate HackerOne-format vulnerability reports from validated security findings.

Community
Advanced
xalgordxalgord
954

performing-exploit-verification

Verifies suspected vulnerabilities with reproducible exploit proof before reporting findings.

Community
Advanced
KentoShimizuKentoShimizu
7

security-vulnerability-management

Prioritize and drive vulnerabilities from SAST/DAST scans to closure.

Community
Advanced