Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →grcengclub/testssl-inspector-expert
Interpret testssl-inspector normalized findings, recommend remediations, and tie evidence back to SCF anchor controls plus SOC 2 / NIST 800-53 r5 / PCI DSS 4.0.1 / ISO 27002:2022 equivalents derived from SCF crosswalks.
Passed 20 of 22 test cases with the skill, and 14 of 22 without it.
and 4 more in the full report
6 fixed14 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
We scanned an SMTP server on port 587 using testssl inspector. What resource URI scheme format is used in the v1 JSON finding document to distinguish STARTTLS scans from HTTPS scans?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies URI scheme prefix starttls+ (such as starttls+<proto>://<host>:<port>/) | Missed | Passed |
The instructions your model reads when the skill loads.
Use this skill when reviewing findings produced by /testssl-inspector:scan. The connector wraps testssl.sh and emits v1 Findings against tls_endpoint resources; this skill translates those into remediation advice an engineer can act on and audit evidence a reviewer can sign off.
Findings live at ~/.cache/claude-grc/findings/testssl-inspector/<run_id>.json. Each document covers one TLS endpoint:
resource.type = "tls_endpoint", resource.id = "<host>:<port>", resource.uri = "https://<host>:<port>/" for HTTPS or resource.uri = "starttls+<proto>://<host>:<port>/" for STARTTLS scansevaluations[] — one entry per (control_framework, control_id, testssl finding) tuplefindings[] — narrative roll-up for CVEs and critical results (cap 50 per doc)metadata.target, metadata.effective_target, metadata.host, metadata.port, metadata.starttls — the original input, the port-expanded target actually scanned, the parsed host/port, and the STARTTLS protocol when applicableMost fails fall into one of five families. The remediation pattern is the same within each family.
IDs: SSLv2, SSLv3, TLS1, TLS1_1. SCF anchors: CRY-01 (Use of Cryptographic Controls), CRY-03 (Transmission of Sensitive Data), NET-09 (Session Authenticity). SCF crosswalk fans these out at scan time — typical resolved targets include NIST SC-08, SC-08(01), SC-08(02), SC-13, SC-23, SI-07(06); SOC 2 CC6.1, CC6.7; PCI 4.2, 4.2.1, 4.2.1.2, 8.3.2; ISO 27002 5.14, 8.24, 8.26.
Remediation:
ELBSecurityPolicy-TLS-1-2-2017-01 or newer. NGINX: ssl_protocols TLSv1.2 TLSv1.3;. Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3.IDs: cipher_negotiated, cipherlist_* (NULL, aNULL, EXPORT, LOW, 3DES_IDEA, OBSOLETED), RC4, std_* variants. SCF anchors: CRY-01.2 (Algorithm Selection), CRY-05 (Cryptographic Protection). Resolved targets typically include NIST SC-13, SC-28, SC-28(01); SOC 2 CC6.1, CC6.7; PCI 3.5, 3.5.1.2, 3.5.1.3, 8.3.2; ISO 27002 8.24.
Remediation:
TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384.(EC)DHE should be disabled in 2026.IDs: cert_expirationStatus, cert_notAfter, cert_signatureAlgorithm, cert_keySize, cert_chain_of_trust, OCSP_*, CT, DNS_CAArecord. SCF anchor: CRY-08 (Public Key Infrastructure). Resolved targets include NIST SC-12 (Key Establishment & Management) and SC-17 (PKI Certificates); SOC 2 CC6.1.
Remediation depends on the specific failure:
test cases passed, vs 14 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.