skill

web-security-testing — Claude Code skill: what it does, how to install

Q: How do I install web-security-testing in Claude Code?

Run `npx claude-code-templates@latest --skill security/web-security-testing` in your terminal. This command downloads and registers the skill template for Claude Code.

Q: Are extra dependencies required for this workflow?

The workflow references helper skills like `scanning-tools`, `broken-authentication`, and `reporting-standards`. You need these companion skills installed in your workspace for every phase to run.

A structured security assessment workflow for checking web apps against OWASP Top 10 flaws. It guides Claude Code through scanning, injection checks, and reporting.

Install into Claude Code · claude-code-templates All methods and platforms ↓

npx claude-code-templates@latest --skill security/web-security-testing

Open on GitHub

What web-security-testing does

This skill sets up a guided path for web vulnerability assessments. The workflow divides work across seven distinct phases. It begins with reconnaissance, moves into injection tests, checks session logic, inspects access controls, verifies HTTP headers, and wraps up with reporting.

The workflow relies on modular sub-skills such as sql-injection-testing, idor-testing, and broken-authentication. Because each stage delegates tasks to these specialized packages, the assistant will fail if those companion skills are missing from your setup. In the final step, it summarizes risk levels and provides remediation steps.

What it helps with

audit web applications against the OWASP Top 10 checklist
inspect HTTP response headers like CSP and HSTS
test endpoints for SQL injection and directory traversal
generate vulnerability reports with remediation steps

Example prompts for the agent

Run reconnaissance on the target web app using @scanning-tools
Check input fields for SQL injection via @sql-injection-testing
Compile the final vulnerability report with @reporting-standards

How to install web-security-testing

1claude-code-templates

npx claude-code-templates@latest --skill security/web-security-testing

2Skills CLI (Vercel)

npx skills add davila7/claude-code-templates --skill web-security-testing -a claude-code

3Manually: put the files in place

~/.claude/skills/web-security-testing/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/web-security-testing/

Manually: put the files in place

.agents/skills/web-security-testing/SKILL.md

For all projects use ~/.agents/skills/

Manually: put the files in place

.cursor/skills/web-security-testing/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install davila7/claude-code-templates web-security-testing

2Manually: put the files in place

.github/skills/web-security-testing/SKILL.md

Platform CLI

gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/web-security-testing

Manually: put the files in place

.devin/skills/web-security-testing/SKILL.md

The legacy .windsurf/skills/ path still works

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about web-security-testing

How do I install web-security-testing in Claude Code?

Run npx claude-code-templates@latest --skill security/web-security-testing in your terminal. This command downloads and registers the skill template for Claude Code.

What does the web-security-testing skill do?

It orchestrates a complete web application audit covering OWASP Top 10 categories. The skill organizes discovery, injection scanning, authentication testing, and reporting.

Are extra dependencies required for this workflow?

The workflow references helper skills like scanning-tools, broken-authentication, and reporting-standards. You need these companion skills installed in your workspace for every phase to run.

Similar skills

All skills for Security →

git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set804

The whole set →

xlsx-official Sets up workflows for creating, editing, and recalculating XLSX, XLSM, CSV, and TSV files. It builds financial models using dynamic formulas instead of static values. 204installs langsmith-tracing Exports Claude Code conversation traces to LangSmith for session tracking and analysis. Runs in the background right after Claude finishes responding. 204installs voice-ai-development Plan voice agents and apps that handle speech input and audio replies. Use it when choosing an approach for calls, transcription, or speech synthesis. 203installs graph-query This skill queries a project’s code graph to trace component links and assess the reach of a change. Use it before editing a function or model. 202installs security-threat-model This skill builds a repository-specific AppSec threat model, ranks abuse paths, and writes a concise Markdown report for a codebase or selected path. 201installs fastapi-pro Guides Claude Code in building async APIs with FastAPI and Pydantic V2. Useful when architecting microservices and structuring database layers. 201installs blueprint-mode-codex A subagent that picks one of four workflows for a task and verifies every step against the project files instead of guessing. 201installs prompt-engineering-instructor Shows your agent how to pull typed data out of model responses with Instructor and Pydantic, retries included. 198installs