# top-web-vulnerabilities

This skill organizes web application flaws by category and explains their causes, impact, and fixes. Use it for security reviews and assessment checklists.

- skill · `type=skill` · Claude Code · 1019 installs
- Author: zebbern
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/top-web-vulnerabilities
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/top-web-vulnerabilities

## What it does

The skill provides a structured reference for web application security issues, including injection flaws, authentication and session problems, data exposure, and configuration errors. Each entry connects a vulnerability with its root cause, likely impact, and mitigation. The material also covers API security, client-side issues, and flaws affecting mobile and IoT systems.

It is intended for systematic reviews and security checklist work. You should understand the client-server model, HTTP, HTML, JavaScript, SQL, XML, APIs, authentication, and authorization. Burp Suite and OWASP ZAP are listed as testing tools. Without those foundations, applying some of the terminology to a project will be harder.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/top-web-vulnerabilities
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill top-web-vulnerabilities -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/top-web-vulnerabilities/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/top-web-vulnerabilities/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/top-web-vulnerabilities/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/top-web-vulnerabilities/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates top-web-vulnerabilities
```

2. **Manually: put the files in place**
- File: `.github/skills/top-web-vulnerabilities/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/top-web-vulnerabilities
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/top-web-vulnerabilities/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/top-web-vulnerabilities

## When to use it
- identify common web application vulnerabilities
- trace the causes of SQL injection and XSS
- assess access-control and session weaknesses
- choose mitigations for API security issues
- build a practical security review checklist

## Example prompts
- Review this web application by vulnerability category and explain each issue, impact, and mitigation.
- Assess the API for authorization flaws, data exposure, and security misconfiguration.
- Create a checklist covering injection, session handling, and protective HTTP headers.

## Similar
- [owasp-top-10-testing](https://affpapa.org/en/nevibecode/skills/owasp-top-10-testing.md) — skill · 12800 installs
- [web-security-review](https://affpapa.org/en/nevibecode/skills/web-security-review.md) — skill · 613 installs
- [exploiting-idor-vulnerabilities](https://affpapa.org/en/nevibecode/skills/exploiting-idor-vulnerabilities.md) — skill · 365 installs
- [testing-for-business-logic-vulnerabilities](https://affpapa.org/en/nevibecode/skills/testing-for-business-logic-vulnerabilities.md) — skill · 333 installs
- [auditing-security](https://affpapa.org/en/nevibecode/skills/auditing-security.md) — skill · 593 installs
- [ctf-web](https://affpapa.org/en/nevibecode/skills/ctf-web.md) — skill · 9700 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md