security-testing

Design and execute security testing programs covering OWASP Top 10, SAST, DAST, dependency scanning, and penetration testing. Outputs test plans, tool configurations, CI integration, and remediation tracking.

Zur Installation springen

Repository: kalilurrahman/kr-claudiator-skills-original-prompts
Letzte Quellaktivität: 22. März 2026 um 13:52
Erkannte Sprache von SKILL.md: Englisch
Sterne: 1
Forks: 0

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts --skill security-testing

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

# .github/workflows/security.yml name: Security Scanning on: push: branches: [main, develop] pull_request: schedule: - cron: '0 6 * * *' # Daily dependency scan jobs: secrets: name: Secrets Scanning runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 # Full history for pre-commit scan - name: Gitleaks uses: gitleaks/gitleaks-action@v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} - name: Trufflehog (additional patterns) uses: trufflesecurity/trufflehog@main with: path: ./ base: ${{ github.event.repository.default_branch }} head: HEAD sast: name: Static Analysis runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Semgrep uses: returntocorp/semgrep-action@v1 with: config: | p/security-audit p/python p/javascript p/owasp-top-ten auditOn: push publishResults: true env: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} - name: Bandit (Python SAST) run: | pip install bandit bandit -r src/ -f json -o bandit-report.json -ll # Only medium+ severity continue-on-error: true - name: Upload SAST results uses: github/codeql-action/upload-sarif@v3 with: sarif_file: bandit-report.json dependencies: name: Dependency Vulnerability Scan runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 # Python - name: Safety check run: | pip install safety safety check --json -o safety-report.json || true python -c " import json, sys report = json.load(open('safety-report.json')) critical = [v for v in report.get('vulnerabilities', []) if v.get('severity') == 'critical'] if critical: print(f'CRITICAL CVEs found: {len(critical)}') for v in critical: print(f' {v[\"package_name\"]} {v[\"analyzed_version\"]}: {v[\"advisory\"]}') sys.exit(1) " # Node.js - name: npm audit run: npm audit --audit-level=critical # Container - name: Trivy container scan uses: aquasecurity/trivy-action@master with: image-ref: 'ghcr.io/${{ github.repository }}:${{ github.sha }}' format: 'sarif' output: 'trivy-results.sarif' severity: 'CRITICAL,HIGH' exit-code: '1' vuln-type: 'os,library' dast: name: DAST (Staging) runs-on: ubuntu-latest needs: [sast, dependencies] if: github.ref == 'refs/heads/main' environment: staging steps: - name: OWASP ZAP Full Scan uses: zaproxy/action-full-scan@v0.10.0 with: target: 'https://staging.api.example.com' rules_file_name: '.zap/rules.tsv' cmd_options: '-a -j' fail_action: false # Report only — don't fail staging deploys continue-on-error: true - name: Upload ZAP report uses: actions/upload-artifact@v4 with: name: zap-report-${{ github.run_id }} path: report_html.html

# Penetration Test Checklist — OWASP Top 10 ## A01: Broken Access Control - [ ] Test horizontal privilege escalation (access other users' data with own token) - [ ] Test vertical privilege escalation (access admin functions with user token) - [ ] Test IDOR (modify resource IDs in requests) - [ ] Test JWT: algorithm confusion (HS256/RS256 swap), none algorithm, expired tokens - [ ] Test CORS: does the API accept arbitrary origins? - [ ] Test directory traversal: /api/files?name=../../etc/passwd ## A02: Cryptographic Failures - [ ] Is PII transmitted over HTTP anywhere? - [ ] Are passwords hashed with bcrypt/argon2 (not MD5/SHA1)? - [ ] Are backup files encrypted? - [ ] Is TLS 1.0/1.1 disabled? ## A03: Injection - [ ] SQL injection: ', "; DROP TABLE--, UNION SELECT - [ ] NoSQL injection: $where, $gt, $ne operators - [ ] Command injection: ; ls, && cat /etc/passwd - [ ] XSS: <script>alert(1)</script>, javascript: in href - [ ] SSTI: {{7*7}}, <%= 7*7 %> ## A04: Insecure Design - [ ] Can users reset any account's password with just an email? - [ ] Are account lockout thresholds reasonable? - [ ] Are rate limits applied to sensitive actions? ## A05: Security Misconfiguration - [ ] Default credentials on admin panels? - [ ] Debug endpoints exposed (/debug, /phpinfo, /actuator)? - [ ] Stack traces in error responses? - [ ] Are cloud storage buckets public? - [ ] Unnecessary services running? ## A06: Vulnerable Components - [ ] Run: trivy image, safety check, npm audit - [ ] Are server headers revealing library versions? ## A07: Authentication Failures - [ ] Password policy: minimum length, breach check? - [ ] Session tokens: random, long, HTTP-only, secure? - [ ] Is there brute force protection on login? - [ ] Are sessions invalidated on logout? - [ ] MFA bypass techniques? ## A08: Software & Data Integrity - [ ] Are software updates verified? (signed packages) - [ ] CI/CD pipeline: can PRs modify workflow files? - [ ] Deserialization: pickle, YAML.load, PHP unserialize ## A09: Logging Failures - [ ] Are failed login attempts logged? - [ ] Are admin actions logged? - [ ] Are logs accessible to developers in production? - [ ] Is sensitive data being logged? ## A10: SSRF - [ ] Any URL parameters fetched by the server? - [ ] File upload: can SVGs/PDFs trigger outbound requests? - [ ] Test internal endpoints: http://169.254.169.254/latest/meta-data

name	security-testing
description	Design and execute security testing programs covering OWASP Top 10, SAST, DAST, dependency scanning, and penetration testing. Outputs test plans, tool configurations, CI integration, and remediation tracking.
argument-hint	["application type","compliance requirements","threat model","existing tooling"]
allowed-tools	Read, Write, Bash

name	security-testing
description	Design and execute security testing programs covering OWASP Top 10, SAST, DAST, dependency scanning, and penetration testing. Outputs test plans, tool configurations, CI integration, and remediation tracking.
argument-hint	["application type","compliance requirements","threat model","existing tooling"]
allowed-tools	Read, Write, Bash

Secrets scanning	Gitleaks, Trufflehog	Every commit	Yes	Code + history
SAST	Semgrep, Bandit (Python)	Every PR	Yes (critical)	Source code
Dependency scan	Dependabot, Trivy, Safety	Daily	Yes (critical CVE)	Dependencies
Container scan	Trivy, Grype	Every image build	Yes (critical)	Docker images
DAST	OWASP ZAP	Staging deploy	No (report only)	Running app
Manual pentest	External firm / internal	Quarterly	N/A	Full scope

security-testing

Installationsoptionen

Quelldateien prüfen