{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/web-security-testing",
  "version": "1.0.0",
  "name": "Web Security Testing",
  "description": "Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.",
  "system_prompt_fragment": "# Web Security Testing Workflow\n\n## Overview\n\nSpecialized workflow for testing web applications against OWASP Top 10 vulnerabilities including injection attacks, XSS, broken authentication, and access control issues.\n\n## When to Use This Workflow\n\nUse this workflow when:\n- Testing web application security\n- Performing OWASP Top 10 assessment\n- Conducting penetration tests\n- Validating security controls\n- Bug bounty hunting\n\n## Workflow Phases\n\n### Phase 1: Reconnaissance\n\n#### Skills to Invoke\n- `scanning-tools` - Security scanning\n- `top-web-vulnerabilities` - OWASP knowledge\n\n#### Actions\n1. Map application surface\n2. Identify technologies\n3. Discover endpoints\n4. Find subdomains\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @scanning-tools to perform web application reconnaissance\n```\n\n### Phase 2: Injection Testing\n\n#### Skills to Invoke\n- `sql-injection-testing` - SQL injection\n- `sqlmap-database-pentesting` - SQLMap\n\n#### Actions\n1. Test SQL injection\n2. Test NoSQL injection\n3. Test command injection\n4. Test LDAP injection\n5. Document vulnerabilities\n\n#### Copy-Paste Prompts\n```\nUse @sql-injection-testing to test for SQL injection\n```\n\n```\nUse @sqlmap-database-pentesting to automate SQL injection testing\n```\n\n### Phase 3: XSS Testing\n\n#### Skills to Invoke\n- `xss-html-injection` - XSS testing\n- `html-injection-testing` - HTML injection\n\n#### Actions\n1. Test reflected XSS\n2. Test stored XSS\n3. Test DOM-based XSS\n4. Test XSS filters\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @xss-html-injection to test for cross-site scripting\n```\n\n### Phase 4: Authentication Testing\n\n#### Skills to Invoke\n- `broken-authentication` - Authentication testing\n\n#### Actions\n1. Test credential stuffing\n2. Test brute force protection\n3. Test session management\n4. Test password policies\n5. Test MFA implementation\n\n#### Copy-Paste Prompts\n```\nUse @broken-authentication to test authentication security\n```\n\n### Phase 5: Access Control Testing\n\n#### Skills to Invoke\n- `idor-testing` - IDOR testing\n- `file-path-traversal` - Path traversal\n\n#### Actions\n1. Test vertical privilege escalation\n2. Test horizontal privilege escalation\n3. Test IDOR vulnerabilities\n4. Test directory traversal\n5. Test unauthorized access\n\n#### Copy-Paste Prompts\n```\nUse @idor-testing to test for insecure direct object references\n```\n\n```\nUse @file-path-traversal to test for path traversal\n```\n\n### Phase 6: Security Headers\n\n#### Skills to Invoke\n- `api-security-best-practices` - Security headers\n\n#### Actions\n1. Check CSP implementation\n2. Verify HSTS configuration\n3. Test X-Frame-Options\n4. Check X-Content-Type-Options\n5. Verify referrer policy\n\n#### Copy-Paste Prompts\n```\nUse @api-security-best-practices to audit security headers\n```\n\n### Phase 7: Reporting\n\n#### Skills to Invoke\n- `reporting-standards` - Security reporting\n\n#### Actions\n1. Document vulnerabilities\n2. Assess risk levels\n3. Provide remediation\n4. Create proof of concept\n5. Generate report\n\n#### Copy-Paste Prompts\n```\nUse @reporting-standards to create security report\n```\n\n## OWASP Top 10 Checklist\n\n- [ ] A01: Broken Access Control\n- [ ] A02: Cryptographic Failures\n- [ ] A03: Injection\n- [ ] A04: Insecure Design\n- [ ] A05: Security Misconfiguration\n- [ ] A06: Vulnerable Components\n- [ ] A07: Authentication Failures\n- [ ] A08: Software/Data Integrity\n- [ ] A09: Logging/Monitoring\n- [ ] A10: SSRF\n\n## Quality Gates\n\n- [ ] All OWASP Top 10 tested\n- [ ] Vulnerabilities documented\n- [ ] Proof of concepts captured\n- [ ] Remediation provided\n- [ ] Report generated\n\n## Related Workflow Bundles\n\n- `security-audit` - Security auditing\n- `api-security-testing` - API security\n- `wordpress-security` - WordPress security",
  "applicable_domains": [
    "frontend"
  ],
  "category": "frontend",
  "invocation": [
    "/web-security-testing"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/web-security-testing",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/web-security-testing",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "frontend",
    "risk-reviewed"
  ],
  "lifecycle": "draft"
}