Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Web Security Testing Workflow · davila7 | DecimalAI

davila7/web-security-testing

SkillScore45Maintained

Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.

Securityby davila7

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/davila7-web-security-testing/SKILL.md

decimalai skills pull davila7-web-security-testing --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/davila7-web-security-testing/SKILL.md https://app.decimal.ai/s/davila7-web-security-testing/SKILL.md

Raw file: /s/davila7-web-security-testing/SKILL.md ↗ · machine-readable summary at /s/davila7-web-security-testing.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 46d ago

Yes — +32% lift+18% tokens0% turns45% of whole cases pass with skill (10/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	-7%	0%
case-14	✗→✓	▲ Improved	-10%	0%
case-15	✗→✓	▲ Improved	-43%	0%
case-16	✗→✓	▲ Improved	34%	0%
case-22	✗→✓	▲ Improved	16%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

davila7 / claude-code-templates

cli-tool/components/skills/security/web-security-testing/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

Web Security Testing Workflow

Overview

Specialized workflow for testing web applications against OWASP Top 10 vulnerabilities including injection attacks, XSS, broken authentication, and access control issues.

When to Use This Workflow

Use this workflow when:

Testing web application security
Performing OWASP Top 10 assessment
Conducting penetration tests
Validating security controls
Bug bounty hunting

Workflow Phases

Phase 1: Reconnaissance

Skills to Invoke

scanning-tools - Security scanning
top-web-vulnerabilities - OWASP knowledge

Actions

Map application surface
Identify technologies
Discover endpoints
Find subdomains
Document findings

Copy-Paste Prompts

Use @scanning-tools to perform web application reconnaissance

Phase 2: Injection Testing

Skills to Invoke

sql-injection-testing - SQL injection
sqlmap-database-pentesting - SQLMap

Actions

Test SQL injection
Test NoSQL injection
Test command injection
Test LDAP injection
Document vulnerabilities

Copy-Paste Prompts

Use @sql-injection-testing to test for SQL injection

Use @sqlmap-database-pentesting to automate SQL injection testing

Phase 3: XSS Testing

Skills to Invoke

xss-html-injection - XSS testing
html-injection-testing - HTML injection

Actions

Test reflected XSS
Test stored XSS
Test DOM-based XSS
Test XSS filters
Document findings

Copy-Paste Prompts

Use @xss-html-injection to test for cross-site scripting

Phase 4: Authentication Testing

Skills to Invoke

broken-authentication - Authentication testing

Actions

Test credential stuffing
Test brute force protection
Test session management
Test password policies
Test MFA implementation

Copy-Paste Prompts

Use @broken-authentication to test authentication security

Phase 5: Access Control Testing

Skills to Invoke

idor-testing - IDOR testing
file-path-traversal - Path traversal

Actions

Test vertical privilege escalation
Test horizontal privilege escalation
Test IDOR vulnerabilities
Test directory traversal
Test unauthorized access

Copy-Paste Prompts

Use @idor-testing to test for insecure direct object references

Use @file-path-traversal to test for path traversal

Phase 6: Security Headers

Skills to Invoke

api-security-best-practices - Security headers

Actions

Check CSP implementation
Verify HSTS configuration
Test X-Frame-Options
Check X-Content-Type-Options
Verify referrer policy

Copy-Paste Prompts

Use @api-security-best-practices to audit security headers

Phase 7: Reporting

Skills to Invoke

reporting-standards - Security reporting

Actions

Document vulnerabilities
Assess risk levels
Provide remediation
Create proof of concept
Generate report

Copy-Paste Prompts

Use @reporting-standards to create security report

OWASP Top 10 Checklist

] A01: Broken Access Control
] A02: Cryptographic Failures
] A03: Injection
] A04: Insecure Design
] A05: Security Misconfiguration
] A06: Vulnerable Components
] A07: Authentication Failures
] A08: Software/Data Integrity
] A09: Logging/Monitoring
] A10: SSRF

Quality Gates

] All OWASP Top 10 tested
] Vulnerabilities documented
] Proof of concepts captured
] Remediation provided
] Report generated

Related Workflow Bundles

security-audit - Security auditing
api-security-testing - API security
wordpress-security - WordPress security

Illustrative Want to see what davila7/web-security-testing would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/13/2026, 12:05 UTC · 22 cases

Lift

+32%

45% vs 14%

Agent turns

0%

1.0 vs 1.0

Tokens

+18%

2,681.82 vs 2,271.18

fail → pass · 7pass → pass · 3fail → fail · 12

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-06 When auditing front-end form controls and URL parameters for client-side script execution risks, what specific types of cross-site scripting vulnerabilities must be evaluated?	fail→fail	15,364	12,040	-22%	1	1	0%	2,605	2,936	+13%	0	0	—
case-01 We are preparing an internal evaluation of our web app against common web vulnerabilities. Please outline a comprehensive assessment plan starting from initial mapping up through final documentation, detailing what checks should be run for inputs, login mechanisms, and permission rules.	fail→fail	23,462	20,891	-11%	1	1	0%	1,982	3,098	+56%	0	0	—
case-02 I need a structured walkthrough to audit our staging portal for security issues like cross-site scripting and unauthorized access. Walk me through the necessary phases and generate a final findings summary format with risk ratings and fixes.	fail→fail	18,082	21,021	+16%	1	1	0%	1,990	3,590	+80%	0	0	—
case-03 Our team wants to conduct a full web security review following industry standard checklists before launch. Provide a step-by-step roadmap covering target discovery, injection checks, header verifications, and remediation reporting.	fail→fail	44,816	16,782	-63%	1	1	0%	3,115	3,910	+26%	0	0	—
case-04 We need to map out our web application surface and discover endpoints prior to vulnerability scanning. What specific reconnaissance actions and initial tool handles should be executed in Phase 1 of an OWASP web review?	fail→pass	16,826	10,751	-36%	1	1	0%	3,005	2,787	-7%	0	0	—
case-05 Our engineering team wants to evaluate input vectors for injection flaws beyond standard SQL syntax errors, including directory service queries and operating system calls. What testing scope applies during injection testing?	fail→fail	15,648	9,553	-39%	1	1	0%	2,521	2,444	-3%	0	0	—
case-07 What specific user credential and session mechanics must be verified during an web authentication audit?	fail→fail	19,427	16,356	-16%	1	1	0%	3,226	3,443	+7%	0	0	—
case-08 When testing user access boundaries and object identifiers on web endpoints, what privilege escalation and authorization concepts should be targeted?	fail→fail	15,787	11,558	-27%	1	1	0%	2,624	2,848	+9%	0	0	—
case-09 We want to verify our web server defensive response headers against HTTP security baselines. What specific response headers need inspection?	fail→fail	12,998	11,412	-12%	1	1	0%	2,356	3,151	+34%	0	0	—
case-10 What key deliverables and summary tasks belong in the final stage of a web application security assessment to ensure actionable remediation?	fail→fail	15,159	11,775	-22%	1	1	0%	2,368	2,766	+17%	0	0	—
case-11 Which specific vulnerability categories make up the official OWASP Top 10 checklist used during web application reviews?	pass→pass	11,756	6,502	-45%	1	1	0%	2,237	2,096	-6%	0	0	—
case-12 In an OWASP Top 10 web assessment, under which designated item code are data-in-transit and sensitive data exposure misconfigurations listed?	pass→pass	4,974	5,663	+14%	1	1	0%	804	1,895	+136%	0	0	—
case-13 When testing a web app for remote server HTTP request relay vulnerabilities, what OWASP Top 10 item designation covers this vulnerability?	pass→pass	4,477	5,306	+19%	1	1	0%	753	1,866	+148%	0	0	—
case-14 Before finalizing a web penetration testing deliverable, what quality gates or completion requirements must be satisfied?	fail→pass	12,838	5,131	-60%	1	1	0%	2,062	1,850	-10%	0	0	—
case-15 If a security team finishes evaluating a core web application and needs complementary testing workflows for specialized targets like content management systems or backend web services, what related workflow bundles exist?	fail→pass	16,543	3,079	-81%	1	1	0%	2,548	1,455	-43%	0	0	—
case-16 A security manager is drafting guidelines on when web security testing workflows should be triggered versus static source code reviews. What operational triggers warrant using this web testing workflow?	fail→pass	15,499	13,844	-11%	1	1	0%	2,409	3,221	+34%	0	0	—
case-22 We are scanning our Terraform HCL infrastructure templates for AWS IAM over-privilege and unencrypted S3 bucket definitions in a CI/CD pipeline. Provide the Infrastructure as Code policy audit workflow.	fail→pass	25,795	16,186	-37%	1	1	0%	3,280	3,789	+16%	0	0	—
case-17 Show the prompt invocations recommended for running manual injection checks and automated database penetration testing in Phase 2.	fail→pass	9,125	7,526	-18%	1	1	0%	709	1,496	+111%	0	0	—
case-18 What specific file system navigation vulnerability should be tested alongside direct object references when evaluating access controls on web applications?	fail→fail	7,144	5,980	-16%	1	1	0%	1,113	1,913	+72%	0	0	—
case-19 Which security knowledge tools or scanning helpers should be invoked during the initial reconnaissance phase of a web application assessment?	fail→pass	15,818	4,149	-74%	1	1	0%	2,404	1,469	-39%	0	0	—
case-20 We need to perform a security audit on a Solidity smart contract for an Ethereum DeFi application. Provide the standard testing workflow phases, compiler analysis steps, and reentrancy detection checks.	fail→fail	24,392	20,254	-17%	1	1	0%	4,019	4,266	+6%	0	0	—
case-21 Our mobile security team needs to perform static reverse engineering on an Android APK file using JADX and Frida to inspect hardcoded secret keys in the DEX binary. Detail the step-by-step binary decompilation workflow.	fail→fail	20,390	19,204	-6%	1	1	0%	1,836	2,711	+48%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +32 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 13.6%
Pass rate with the skill: 45.5%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/13/2026, 12:05 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Prompt

We need to map out our web application surface and discover endpoints prior to vulnerability scanning. What specific reconnaissance actions and initial tool handles should be executed in Phase 1 of an OWASP web review?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run45

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+54% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 46 days ago

Other measured skills in the registry, with their headline benchmark lift.