This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy".
SkillScore88Maintained
Automatic
◆Security & AppSec pack
Last verified 8/30/2026
What it changes
Passed 22 of 25 test cases with the skill, and 20 of 25 without it.
Without skill80%
With skill88%
Checks it passed that the model alone missed
Recommends non-destructive verification techniques such as passive syntax error observation.
Recommends implementing strict domain allowlists and restricting outbound network access from the application server.
2 fixed20 passed either way3 still failing0 broke
Pass-rate lift
+8 pp
Tokens
+40%
Agent turns
0%
Response time
-13%
Model gemini-3.6-flashMeasured 8/30/2026v122 of 25 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
A feature in a web app fetches images from user-provided URLs. To block Server-Side Request Forgery (SSRF) targeting internal services, a developer added a regex check blocking URLs containing `localhost` or `127.0.0.1`. Demonstrate why this blacklist is unsafe and state the comprehensive network and application level mitigations for SSRF.
What was checked, without and with the skill
Checked
Without skill
With skill
Explains that IP host blacklists can be bypassed using alternative IP representations or private IP ranges.
Passed
Passed
Recommends implementing strict domain allowlists and restricting outbound network access from the application server.
Missed
Passed
case-12 · gemini-3.6-flash · 8/30/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md47 linessingle file
Top 100 Web Vulnerabilities Reference
Purpose
Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats. Content organized into 15 major vulnerability categories aligned with industry standards and real-world attack patterns.
Prerequisites
Basic understanding of web application architecture (client-server model, HTTP protocol)
Familiarity with common web technologies (HTML, JavaScript, SQL, XML, APIs)
Understanding of authentication and authorization concepts
Access to web application security testing tools (Burp Suite, OWASP ZAP)
Knowledge of secure coding principles recommended
Outputs and Deliverables
Complete vulnerability catalog with definitions, root causes, impacts, and mitigations
Category-based vulnerability groupings for systematic assessment
Quick reference for security testing and remediation
Foundation for vulnerability assessment checklists and security policies
Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.