skill CX Codex

web-security-scanner-pro — Claude Code skill

Q: How do I install web-security-scanner-pro in Claude Code?

Run `npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a claude-code`. The skill file lands at `~/.claude/skills/web-security-scanner-pro/SKILL.md`.

Q: What does the scanner need to run?

Python 3.9 or newer and the dependencies from `requirements.txt`. Without the cloned repository and installed packages, the scanner commands will not start.

A skill that teaches your agent to drive Web Security Scanner Pro: 49 modules, WAF evasion, CMS checks and HTML or PDF reports.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a claude-code

Open on GitHub

What web-security-scanner-pro does

This skill covers running Web Security Scanner Pro, an open-source Python scanner. Its 49 modules look for XSS, SQL injection, LFI, RFI, XXE, SSTI, CSRF and command injection. Separate sets handle WordPress, Joomla and Drupal, plus misconfigurations in Apache, Nginx, IIS, LiteSpeed and Tomcat. A built-in CVE database covers 2024–2026.

Evasion is part of the package: user-agent rotation, random delays, exponential backoff, proxy support. The scanner recognises 9 WAFs, Cloudflare, Sucuri and ModSecurity among them. Findings go out as HTML, PDF, Markdown or JSON, and a REST API is available for CI/CD.

You need Python 3.9 or newer and the packages in requirements.txt: requests, beautifulsoup4, pyyaml, jinja2, reportlab, flask. Installing the skill alone gets you nothing here — without the cloned repo and its dependencies, commands like python main.py scan https://example.com fail. Settings live in config.yaml: timeouts, threads, evasion modes, proxies and the module list.

What it helps with

run a quick pass over four critical modules
find SQL injection and XSS in forms and parameters
check WordPress and its plugins against known flaws
produce a scan report as HTML and PDF
scan a Cloudflare-protected site in stealth mode

Example prompts for the agent

Scan https://example.com in stealth mode and give me HTML and PDF reports
Check WordPress for vulnerabilities with the wordpress,xss,sqli modules
Run a full scan and show only CRITICAL and HIGH findings

How to install web-security-scanner-pro

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a claude-code

2Manually: put the files in place

~/.claude/skills/web-security-scanner-pro/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/web-security-scanner-pro/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a codex

2Manually: put the files in place

.agents/skills/web-security-scanner-pro/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a cursor

2Manually: put the files in place

.cursor/skills/web-security-scanner-pro/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install reason-machines/security-skills web-security-scanner-pro

2Manually: put the files in place

.github/skills/web-security-scanner-pro/SKILL.md

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a gemini-cli

2Platform CLI

gemini skills install https://github.com/reason-machines/security-skills --path skills/web-security-scanner-pro

Manually: put the files in place

.devin/skills/web-security-scanner-pro/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about web-security-scanner-pro

How do I install web-security-scanner-pro in Claude Code?

Run npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a claude-code. The skill file lands at ~/.claude/skills/web-security-scanner-pro/SKILL.md.

What does web-security-scanner-pro do?

It lets your agent run Web Security Scanner Pro: scanning sites for 49 vulnerability types, checking CMS platforms and server configs, evading WAFs and writing reports.

What does the scanner need to run?

Python 3.9 or newer and the dependencies from requirements.txt. Without the cloned repository and installed packages, the scanner commands will not start.

Similar skills

All skills for Security →

git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set24

malware-repository-warning The skill triggers when someone asks for help with a crack, keygen or pre-activated antivirus, and answers with a warning instead of setup steps. CX Codex +1 851installs edgesecurityaccess-wireguard-vpn This skill walks the agent through standing up a WireGuard VPN: build the Go server, add users, and hand out configs over an HTTP API. CX Codex +1 788installs sparkfinderoven-security-compliance-skills A suite of commands and workflows for security and compliance work: OWASP scanning, CVE detection, GDPR audits, SOC 2 readiness, threat modeling. CX Codex +1 759installs pentestify-security-report-generator A skill that turns pentest findings into a structured report: vulnerability tracking, live risk stats and PDF export. CX Codex +1 747installs sparkfinderoven-r01-security-compliance-skills A skill suite that scans code for OWASP vulnerabilities, checks dependencies for CVEs, audits GDPR and SOC 2 readiness, and builds STRIDE threat models. CX Codex +1 729installs esaa-security-audit This skill runs 95 checks across 16 security domains and records every finding as an immutable event, so the same repo state yields the same report. CX Codex +1 717installs foundry-security-spec A skill that walks your agent through implementing Cisco's Foundry spec: a multi-role system for finding and validating vulnerabilities. Useful when you're building your own evaluation pipeline. CX Codex +1 683installs linux-pentester-command-reference A skill that hands your agent a Linux command reference split by pentest phase: recon, enumeration, exploitation, privesc. CX Codex +1 308installs