This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy".
SkillScore83Maintained
Automatic
◆Security & AppSec pack
Last verified 8/10/2026
What it changes
Passed 20 of 24 test cases with the skill, and 19 of 24 without it.
Without skill79%
With skill83%
Checks it passed that the model alone missed
Recommends centralized server-side validation
Identifies the vulnerability pattern as Inconsistent Validation
1 fixed19 passed either way4 still failing0 broke
Pass-rate lift
+4 pp
Tokens
+250%
Agent turns
0%
Response time
-10%
Model gemini-3.6-flashMeasured 8/10/2026v120 of 24 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
An e-commerce site validates user input length on the mobile API using strict regex, but the desktop web API relies on client-side JS validation only. What vulnerability pattern is present here?
What was checked, without and with the skill
Checked
Without skill
With skill
Identifies the vulnerability pattern as Inconsistent Validation
Missed
Passed
Recommends centralized server-side validation
Missed
Passed
case-19 · gemini-3.6-flash · 8/10/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md535 linessingle file
Top 100 Web Vulnerabilities Reference
Purpose
Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats. Content organized into 15 major vulnerability categories aligned with industry standards and real-world attack patterns.
Prerequisites
Basic understanding of web application architecture (client-server model, HTTP protocol)
Familiarity with common web technologies (HTML, JavaScript, SQL, XML, APIs)
Understanding of authentication and authorization concepts
Access to web application security testing tools (Burp Suite, OWASP ZAP)
Knowledge of secure coding principles recommended
Outputs and Deliverables
Complete vulnerability catalog with definitions, root causes, impacts, and mitigations
Category-based vulnerability groupings for systematic assessment
Quick reference for security testing and remediation
Foundation for vulnerability assessment checklists and security policies
Core Workflow
Phase 1: Injection Vulnerabilities Assessment
Evaluate injection attack vectors targeting data processing components:
SQL Injection (1)
Definition: Malicious SQL code inserted into input fields to manipulate database queries
Root Cause: Lack of input validation, improper use of parameterized queries
Impact: Unauthorized data access, data manipulation, database compromise
Mitigation: Use parameterized queries/prepared statements, input validation, least privilege database accounts
Cross-Site Scripting - XSS (2)
Definition: Injection of malicious scripts into web pages viewed by other users
Root Cause: Insufficient output encoding, lack of input sanitization
Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.