Skip to main content Skills Marketplace Découvrez et explorez les compétences IA créées par la communauté.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Afficher les détails du prompt Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/proffesor-for-testing/sentinel-api-testing --skill security-testingLa commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Télécharger Zip Téléchargement... Métiers associés SOC
Basé sur la classification professionnelle SOC
name security-testing description Test for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices. category specialized-testing priority critical tokenEstimate 1200 agents ["qe-security-scanner","qe-api-contract-validator","qe-quality-analyzer"] implementation_status optimized optimization_version 1 last_optimized 2025-12-02T00:00:00.000Z dependencies [] quick_reference_card true tags ["security","owasp","sast","dast","vulnerabilities","auth","injection"]
Security Testing
<default_to_action>
When testing security or conducting audits:
TEST OWASP Top 10 vulnerabilities systematically
VALIDATE authentication and authorization on every endpoint
SCAN dependencies for known vulnerabilities (npm audit)
CHECK for injection attacks (SQL, XSS, command)
VERIFY secrets aren't exposed in code/logs
Quick Security Checks:
Access control → Test horizontal/vertical privilege escalation
Crypto → Verify password hashing, HTTPS, no sensitive data exposed
Injection → Test SQL injection, XSS, command injection
Auth → Test weak passwords, session fixation, MFA enforcement
Config → Check error messages don't leak info
Critical Success Factors:
Think like an attacker, build like a defender
Security is built in, not added at the end
Test continuously in CI/CD, not just before release
</default_to_action>
Quick Reference Card
When to Use
Security audits and penetration testing
Testing authentication/authorization
Validating input sanitization
Reviewing security configuration
OWASP Top 10 (2021)
# Vulnerability Key Test 1 Broken Access Control User A accessing User B's data 2 Cryptographic Failures Plaintext passwords, HTTP 3 Injection SQL/XSS/command injection 4 Insecure Design Rate limiting, session timeout 5 Security Misconfiguration Verbose errors, exposed /admin 6 Vulnerable Components npm audit, outdated packages 7 Auth Failures Weak passwords, no MFA 8 Integrity Failures Unsigned updates, malware 9 Logging Failures No audit trail for breaches 10 SSRF Server fetching internal URLs
Tools
SAST SonarQube, Semgrep Static code analysis DAST OWASP ZAP, Burp Dynamic scanning Deps npm audit, Snyk Dependency vulnerabilities Secrets git-secrets, TruffleHog Secret scanning
Agent Coordination
qe-security-scanner: Multi-layer SAST/DAST scanningqe-api-contract-validator: API security testingqe-quality-analyzer: Security code review
Key Vulnerability Tests
1. Broken Access Control
test ('user cannot access another user\'s order' , async () => {
const userAToken = await login ('userA' );
const userBOrder = await createOrder ('userB' );
const response = await api.get (`/orders/${userBOrder.id} ` , {
headers : { Authorization : `Bearer ${userAToken} ` }
});
expect (response.status ).toBe (403 );
});
test ('regular user cannot access admin' , async () => {
const userToken = await login ('regularUser' );
expect ((await api.get ('/admin/users' , {
headers : { Authorization : `Bearer ${userToken} ` }
})).status ).toBe (403 );
});
2. Injection Attacks
test ('prevents SQL injection' , async () => {
const malicious = "' OR '1'='1" ;
const response = await api.get (`/products?search=${malicious} ` );
expect (response.body .length ).toBeLessThan (100 );
});
test ('sanitizes HTML output' , async () => {
const xss = '<script>alert("XSS")</script>' ;
await api.post ('/comments' , { text : xss });
const html = (await api.get ('/comments' )).body ;
expect (html).toContain ('<script>' );
expect (html).not .toContain ('<script>' );
});
3. Cryptographic Failures test ('passwords are hashed' , async () => {
await db.users .create ({ email : 'test@example.com' , password : 'MyPassword123' });
const user = await db.users .findByEmail ('test@example.com' );
expect (user.password ).not .toBe ('MyPassword123' );
expect (user.password ).toMatch (/^\$2[aby]\$\d{2}\$/ );
});
test ('no sensitive data in API response' , async () => {
const response = await api.get ('/users/me' );
expect (response.body ).not .toHaveProperty ('password' );
expect (response.body ).not .toHaveProperty ('ssn' );
});
4. Security Misconfiguration test ('errors don\'t leak sensitive info' , async () => {
const response = await api.post ('/login' , { email : 'nonexistent@test.com' , password : 'wrong' });
expect (response.body .error ).toBe ('Invalid credentials' );
});
test ('sensitive endpoints not exposed' , async () => {
const endpoints = ['/debug' , '/.env' , '/.git' , '/admin' ];
for (let ep of endpoints) {
expect ((await fetch (`https://example.com${ep} ` )).status ).not .toBe (200 );
}
});
5. Rate Limiting test ('rate limiting prevents brute force' , async () => {
const responses = [];
for (let i = 0 ; i < 20 ; i++) {
responses.push (await api.post ('/login' , { email : 'test@example.com' , password : 'wrong' }));
}
expect (responses.filter (r =>status === 429 ).length ).toBeGreaterThan (0 );
});
Security Checklist
Authentication
Authorization
Data Protection
Input Validation
CI/CD Integration
security-checks:
steps:
- name: Dependency audit
run: npm audit --audit-level=high
- name: SAST scan
run: npm run sast
- name: Secret scan
uses: trufflesecurity/trufflehog@main
- name: DAST scan
if: github.ref == 'refs/heads/main'
run: docker run owasp/zap2docker-stable zap-baseline.py -t https://staging.example.com
#!/bin/sh
git-secrets --scan
npm run lint:security
Agent-Assisted Security Testing
await Task ("Security Scan" , {
target : 'src/' ,
layers : { sast : true , dast : true , dependencies : true , secrets : true },
severity : ['critical' , 'high' , 'medium' ]
}, "qe-security-scanner" );
await Task ("OWASP Scan" , {
categories : ['broken-access-control' , 'injection' , 'cryptographic-failures' ],
depth : 'comprehensive'
}, "qe-security-scanner" );
await Task ("Validate Fix" , {
vulnerability : 'CVE-2024-12345' ,
expectedResolution : 'upgrade package to v2.0.0' ,
retestAfterFix : true
}, "qe-security-scanner" );
Agent Coordination Hints
Memory Namespace aqe/security/
├── scans/* - Scan results
├── vulnerabilities/* - Found vulnerabilities
├── fixes/* - Remediation tracking
└── compliance/* - Compliance status
Fleet Coordination const securityFleet = await FleetManager .coordinate ({
strategy : 'security-testing' ,
agents : [
'qe-security-scanner' ,
'qe-api-contract-validator' ,
'qe-quality-analyzer' ,
'qe-deployment-readiness'
],
topology : 'parallel'
});
Common Mistakes
❌ Security by Obscurity Hiding admin at /super-secret-admin → Use proper auth
❌ Client-Side Validation Only JavaScript validation can be bypassed → Always validate server-side
❌ Trusting User Input Assuming input is safe → Sanitize, validate, escape all input
❌ Hardcoded Secrets API keys in code → Environment variables, secret management
Related Skills
Remember Think like an attacker: What would you try to break? Test that.
Build like a defender: Assume input is malicious until proven otherwise.
Test continuously: Security testing is ongoing, not one-time.
With Agents: Agents automate vulnerability scanning, track remediation, and validate fixes. Use agents to maintain security posture at scale.
