security-testing
Skill1 starsChanged 52 days agoMITView on GitHub
Use for authorized security/penetration testing of web apps and APIs — OWASP Top 10 checks, auth/session testing, header/config audits, and vulnerability triage. Only for systems the user owns or has explicit authorization to test.
9 other projects use a version of this, 1 of them edited.
Adopted by
Most recently taken up by
- AnyOrgName/php-skillstheir own version, first seen Nov 8, 2026
- joe-qai/qa-skillstheir own version, first seen Nov 8, 2026
- petrkindlmann/qa-skillstheir own version, first seen Oct 25, 2026
- proffesor-for-testing/agentic-qetheir own version, first seen Oct 25, 2026
- d-padmanabhan/agent-engineering-handbooktheir own version, first seen Sep 18, 2026
- mejbaurbahar/fagunedited, first seen Jul 5, 2026
Other versions9 projects use a version of this.
Word for word · 0
None found.
Edited · 1
- mejbaurbahar/fagun★ 112% same
Wrote their own version · 8
- proffesor-for-testing/agentic-qe★ 524same name
- petrkindlmann/qa-skills★ 209same name
- mn-youssef/security-skills★ 47same name
- joe-qai/qa-skills★ 30same name
- d-padmanabhan/agent-engineering-handbook★ 17same name
- AnyOrgName/php-skills★ 4same name
- Marnie0415/pi-skills★ 1same name
- mmondora/claude-skills★ 1same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository98 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- 42crunch-api-security-testingSkill
- a-b-testingSkill
- acceptance-testingSkill
- accessibility-testingSkill
- ai-agent-evaluationSkill
- ai-code-securitySkill
- ai-ml-testingSkill
- analytics-tracking-testingSkill
- api-testingSkill
- authn-authz-testingSkill
- autonomous-qa-orchestrationSkill
- bdd-gherkin-testingSkill
- blockchain-smart-contract-testingSkill
- bug-reportingSkill
- chaos-resilience-testingSkill
- chatbot-voice-agent-testingSkill
- cicd-testingSkill
- cli-testingSkill
- cloud-infrastructure-testingSkill
- code-coverage-analysisSkill
- compatibility-testingSkill
- compliance-testingSkill
- concurrency-race-condition-testingSkill
- configuration-feature-flag-testingSkill
- contract-testingSkill
- cross-browser-testingSkill
- database-testingSkill
- data-migration-testingSkill
- data-pipeline-etl-testingSkill
- date-time-timezone-testingSkill
- desktop-app-testingSkill
- disaster-recovery-backup-testingSkill
- e2e-testingSkill
- email-notification-testingSkill
- event-driven-messaging-testingSkill
- exploratory-testingSkill
- flaky-test-managementSkill
- functional-testingSkill
- fuzz-testingSkill
- game-testingSkill
- graphql-testingSkill
- iac-container-security-testingSkill
- installation-upgrade-testingSkill
- integration-testingSkill
- iot-embedded-testingSkill
- llm-security-auditSkill
- llm-testingSkill
- localization-testingSkill
- manual-testingSkill
- mcp-testingSkill
- memory-leak-resource-testingSkill
- microservices-testingSkill
- mobile-testingSkill
- mutation-testingSkill
- observability-testingSkill
- payment-ecommerce-testingSkill
- performance-testingSkill
- production-monitoring-synthetic-testingSkill
- The first 60 shown.
The file
Files
Security Testing
Scope guardrail: test only systems you own or have explicit written authorization to test (your product, client engagements, CTFs, in-scope bug bounties). Prefer staging with synthetic data. Do not run destructive payloads, denial-of-service, or mass scans of third-party infrastructure; propose a safe alternative instead.
Approach
- Model threats first (
threat-modeling): assets, entry points, trust boundaries. - Automate the cheap wins in CI: static analysis (
static-analysis-testing), dependency and secret scanning (supply-chain-dependency-testing), IaC/container checks (iac-container-security-testing). - Test authentication and authorization deliberately (
authn-authz-testing); this is where the worst bugs live. - Manually probe business logic: automation cannot understand your rules.
- Report, fix, and add a regression test for every finding.
OWASP Top 10 quick-check pass
| Risk | What to check |
| Broken access control | Object IDs across users/tenants (IDOR), function-level checks (can a normal user call an admin route?), path traversal on file endpoints, forced browsing |
| Cryptographic failures | Secrets/PII in plaintext (logs, DB, responses), HTTPS everywhere + HSTS, weak/default credentials on new installs, sensitive data in URLs |
| Injection | SQL/NoSQL/OS/LDAP/template injection in every input incl. headers and filenames; use parameterized queries and output encoding |
| Insecure design | No rate limit on login/reset/OTP, business rules trusting client values (price, role), missing abuse-case handling |
| Security misconfiguration | Verbose errors/stack traces, default admin panels, directory listing, debug mode, open cloud storage, missing headers |
| Vulnerable/outdated components | Known-CVE libraries and plugins (SCA scan), unsupported runtimes |
| Authentication failures | Weak password policy, no lockout, session not rotated on login, tokens not invalidated on logout, predictable IDs, MFA gaps |
| Software/data integrity | Unsigned updates/webhooks, insecure deserialization, CI/CD exposure |
| Logging & monitoring failures | No audit trail for privileged actions, no alerting on repeated failures |
| SSRF | Any server-side "fetch this URL" feature (webhooks, image/PDF from URL) must block internal ranges and cloud metadata addresses |
Fast header and cookie audit
curl -sI https://staging.example.com | grep -iE "strict-transport|content-security|x-content-type|x-frame|referrer-policy|permissions-policy|set-cookie|server|x-powered-by"Expect: Strict-Transport-Security, a Content-Security-Policy that is strict yet does not break legitimate features, X-Content-Type-Options: nosniff, frame-ancestors or X-Frame-Options, Referrer-Policy; cookies Secure; HttpOnly; SameSite; no version banners.
Session and account flows
Session ID changes after login (fixation) · logout invalidates the token server-side (replay the old token) · password-reset tokens are single-use, short-lived and not leaked via URL/referrer · MFA cannot be skipped via another endpoint · multi-tenant isolation on every read and write.
Tools (use only on authorized targets)
| Purpose | Tools |
| Intercepting proxy, manual testing | Burp Suite, OWASP ZAP, mitmproxy |
| Automated baseline scan on staging | ZAP baseline/API scan, Nuclei templates |
| Static/secret/dependency scanning | Semgrep, CodeQL, gitleaks, Trivy, OSV-Scanner |
| TLS | testssl.sh, sslyze |
| API contract security | 42crunch-api-security-testing |
Triage and severity
Rate by real-world exploitability and impact, not only category: an unauthenticated IDOR leaking personal data is Critical; a missing header on a static marketing page is Minor. Reproduce, document minimal steps, and share findings through the private channel your team uses. Do not put working exploit chains in widely shared reports beyond what is needed to verify the fix. Use bug-reporting.
Related
security-owasp, security-hardening, authn-authz-testing, threat-modeling, static-analysis-testing, supply-chain-dependency-testing, compliance-testing
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.