# web-security-scanner-pro

A skill that teaches your agent to drive Web Security Scanner Pro: 49 modules, WAF evasion, CMS checks and HTML or PDF reports.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 607 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/web-security-scanner-pro/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/web-security-scanner-pro

## What it does

This skill covers running Web Security Scanner Pro, an open-source Python scanner. Its 49 modules look for XSS, SQL injection, LFI, RFI, XXE, SSTI, CSRF and command injection. Separate sets handle WordPress, Joomla and Drupal, plus misconfigurations in Apache, Nginx, IIS, LiteSpeed and Tomcat. A built-in CVE database covers 2024–2026.

Evasion is part of the package: user-agent rotation, random delays, exponential backoff, proxy support. The scanner recognises 9 WAFs, Cloudflare, Sucuri and ModSecurity among them. Findings go out as HTML, PDF, Markdown or JSON, and a REST API is available for CI/CD.

You need Python 3.9 or newer and the packages in `requirements.txt`: `requests`, `beautifulsoup4`, `pyyaml`, `jinja2`, `reportlab`, `flask`. Installing the skill alone gets you nothing here — without the cloned repo and its dependencies, commands like `python main.py scan https://example.com` fail. Settings live in `config.yaml`: timeouts, threads, evasion modes, proxies and the module list.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/web-security-scanner-pro/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/web-security-scanner-pro/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/web-security-scanner-pro/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/web-security-scanner-pro/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills web-security-scanner-pro
```

2. **Manually: put the files in place**
- File: `.github/skills/web-security-scanner-pro/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/web-security-scanner-pro
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/web-security-scanner-pro/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill web-security-scanner-pro -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/web-security-scanner-pro/SKILL.md

## When to use it
- run a quick pass over four critical modules
- find SQL injection and XSS in forms and parameters
- check WordPress and its plugins against known flaws
- produce a scan report as HTML and PDF
- scan a Cloudflare-protected site in stealth mode

## Example prompts
- Scan https://example.com in stealth mode and give me HTML and PDF reports
- Check WordPress for vulnerabilities with the wordpress,xss,sqli modules
- Run a full scan and show only CRITICAL and HIGH findings

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 24 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md