Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.
SkillScore96Maintained
Automatic
◆Security & AppSec pack
Last verified 8/28/2026
What it changes
Passed 23 of 24 test cases with the skill, and 18 of 24 without it.
Without skill75%
With skill96%
Checks it passed that the model alone missed
includes vulnerability range 1-13
includes vulnerability range 37-39
includes vulnerability range 40-44
and 5 more in the full report
5 fixed18 passed either way1 still failing0 broke
Pass-rate lift
+21 pp
Tokens
+220%
Agent turns
0%
Response time
-29%
Model gemini-3.6-flashMeasured 8/28/2026v1 · latest is v223 of 24 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
In an OWASP Top 10 mapping, which specific numbered vulnerabilities correspond to A08: Software and Data Integrity Failures?
What was checked, without and with the skill
Checked
Without skill
With skill
includes vulnerability numbers 45-47
Missed
Passed
case-24 · gemini-3.6-flash · 8/28/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md41 lines2 files
⚠️ AUTHORIZED USE ONLY
This skill is for educational purposes or authorized security assessments only.
You must have explicit, written permission from the system owner before using this tool.
Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate
Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
Ask the user to state the exact target URL, IP, account, or resource.
Ask the user to confirm written authorization and the permitted scope.
Show the exact command(s) and explain their expected effect.
Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
Top 100 Web Vulnerabilities Reference
Detailed Guide
Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.
Prerequisites
Basic understanding of web application architecture (client-server model, HTTP protocol)
Familiarity with common web technologies (HTML, JavaScript, SQL, XML, APIs)
Understanding of authentication and authorization concepts
Access to web application security testing tools (Burp Suite, OWASP ZAP)
Knowledge of secure coding principles recommended
Constraints and Limitations
Vulnerability definitions represent common patterns; specific implementations vary
Mitigations must be adapted to technology stack and architecture
New vulnerabilities emerge continuously; reference should be updated
Some vulnerabilities overlap across categories (e.g., IDOR appears in multiple contexts)
Effectiveness of mitigations depends on proper implementation
Automated scanners cannot detect all vulnerability types (especially business logic)
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability defin