web-app-pentest

Sterne4

Forks1

Aktualisiert15. Juni 2026 um 15:38

Black-box pentest of the Next.js storefront + admin. Auth flows, CSRF, XSS, client-side access control, cookie flags, CSP. Run before major releases.

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

yasinatesim

yasinatesim/sklent

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

InformationssicherheitsanalystenInformatik- und Mathematikberufe·SOC 15-1212

SKILL.md

readonly

name	web-app-pentest
description	Black-box pentest of the Next.js storefront + admin. Auth flows, CSRF, XSS, client-side access control, cookie flags, CSP. Run before major releases.

web-app-pentest

Black-box test of the web surface. Probe: login/register/refresh flows, CSRF double-submit, stored and reflected XSS, client-side route guards vs server-side enforcement, cookie flags (httpOnly/Secure/SameSite), CSP and security headers. File findings under Phase S.

Mehr aus diesem Repository

gleiches Repository

braid-plan

yasinatesim/sklent

Generate a BRAID reasoning graph (Mermaid flowchart TD) for a complex multi-step task. Cache to .local-artifacts/braid/<task-slug>.mmd. Hand to the braid-solver agent for execution. Use before non-trivial features, multi-hypothesis debugging, architecture decisions.

2026-06-154

coverage-gate

yasinatesim/sklent

Run unit-test coverage for the changed surface and block if below threshold. Backend (Go) via go test -cover. Frontend (web) via vitest --coverage. Threshold 70% now, target 80%. Reports delta vs base branch.

2026-06-154

intended-vs-implemented

yasinatesim/sklent

Audit the gap between what the code is documented to do and what it actually does. Run before claiming any feature works, before a release, and whenever a doc/README/CLAUDE.md says a subsystem is "done". Turns "Presence ≠ completeness" into a repeatable check. Especially for marketplace sync, payment, invoice.

2026-06-154

issue-create

yasinatesim/sklent

Create a GitHub issue with required milestone + labels + body template. Enforces the "no issue, no branch" rule. Returns the issue number for the branch name.

2026-06-154

playwright-snapshot

yasinatesim/sklent

Capture Playwright snapshots + screenshots for a list of URLs. Saves artifacts to .local-artifacts/screenshots/<branch>/. Lightweight helper invoked by wtf-ux-playwright or directly when verifying a specific surface.

2026-06-154

api-pentest

yasinatesim/sklent

Black-box pentest of the Go/Gin REST API. JWT handling, IDOR, rate limiting, payment-callback verification, business-logic abuse. Run before major releases.

2026-06-154

Jeden Skill mit einem Klick ausführen