Menu
Testing dinámico de endpoints web: XSS (DalFox), SQLi (sqlmap), Nuclei.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
Detecta el Bus Factor por modulo en un repositorio git usando el algoritmo CST(change-size-ratio). Genera JSON con BF, owners, riesgo, y avisa cuando un solo dev conoce un modulo critico.
Genera CONTEXT_DOME.md para modulos con Bus Factor bajo. Captura conocimiento tacito: proposito, decisiones no obvias, dependencias, runbook minimo, knowledge owners y plan de distribucion.
Usar cuando se quiere ejecutar tareas de bajo riesgo de forma autónoma durante la noche.
Mapear la superficie de ataque de un dominio: subdominios, OSINT, typosquatting.
| name | dynamic-web-tester |
| description | Testing dinámico de endpoints web: XSS (DalFox), SQLi (sqlmap), Nuclei. |
| summary | Testing dinamico controlado contra endpoints web en staging. REQUIERE autorizacion explicita. Modo conservador por defecto (level 1, safe). Complementa pentesting skill con deteccion activa de XSS y SQLi. |
| maturity | stable |
| context | fork |
| context_cost | medium |
| category | security |
| tags | ["xss","sqli","dalfox","sqlmap","nuclei","pentest-web","dynamic-testing"] |
| priority | high |
| authorization_required | true |
Este skill ejecuta herramientas de testing activo contra endpoints HTTP. Nunca ejecutar contra producción directamente. Requiere autorización escrita del propietario.
1. Verificar autorización → output/security/authorization-{host}.txt
2. DalFox — XSS scanning (reflected, DOM, stored)
3. sqlmap — SQL injection (level 1 risk 1 batch — conservador)
4. Nuclei — templates web: xss, sqli, lfi
5. Report → output/security/dynamic-test-{host}-YYYYMMDD.json
# Crear autorización primero
echo "AUTHORIZED" > output/security/authorization-localhost.txt
# Ejecutar en modo seguro (default)
bash scripts/dynamic-web-security-test.sh \
--target http://localhost:8080 \
--tools xss,sqli,nuclei \
--safe
| Herramienta | Imagen Docker | Función |
|---|---|---|
| DalFox | ghcr.io/hahwul/dalfox:latest | XSS detection |
| sqlmap | paoloo/sqlmap | SQL injection |
| Nuclei | projectdiscovery/nuclei | CVE/web templates |
--level 1 --risk 1 --batch — sin payloads destructivos--silence — solo findingsoutput/security/
authorization-{host}.txt
dynamic-test-{host}-YYYYMMDD.json ← report consolidado
dynamic-test-{host}-YYYYMMDD/
dalfox-results.json
sqlmap/
nuclei-results.json
nuclei-scanning skill (CVEs de tech stack)Sin output/security/authorization-{host}.txt con "AUTHORIZED" y < 30 días,
el script aborta con exit 1.