# web-security-testing

A structured security assessment workflow for checking web apps against OWASP Top 10 flaws. It guides Claude Code through scanning, injection checks, and reporting.

- skill · `type=skill` · Claude Code · 201 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/web-security-testing
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/web-security-testing

## What it does

This skill sets up a guided path for web vulnerability assessments. The workflow divides work across seven distinct phases. It begins with reconnaissance, moves into injection tests, checks session logic, inspects access controls, verifies HTTP headers, and wraps up with reporting.

The workflow relies on modular sub-skills such as `sql-injection-testing`, `idor-testing`, and `broken-authentication`. Because each stage delegates tasks to these specialized packages, the assistant will fail if those companion skills are missing from your setup. In the final step, it summarizes risk levels and provides remediation steps.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/web-security-testing
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill web-security-testing -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/web-security-testing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/web-security-testing/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/web-security-testing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/web-security-testing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates web-security-testing
```

2. **Manually: put the files in place**
- File: `.github/skills/web-security-testing/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/web-security-testing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/web-security-testing/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/web-security-testing

## When to use it
- audit web applications against the OWASP Top 10 checklist
- inspect HTTP response headers like CSP and HSTS
- test endpoints for SQL injection and directory traversal
- generate vulnerability reports with remediation steps

## Example prompts
- Run reconnaissance on the target web app using `@scanning-tools`
- Check input fields for SQL injection via `@sql-injection-testing`
- Compile the final vulnerability report with `@reporting-standards`

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 804 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md