chaos-security-testing

Étoiles7

Forks5

Mis à jour17 mai 2026 à 06:37

Run chaos security engineering tests — AI agent attempts to hack the Sprint output and reports findings to the team

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Source

timwukp

timwukp/Kiro-SDLC-Scrum-best-practics

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

Explorateur de fichiers

2 fichiers

SKILL.md

readonly

name	chaos-security-testing
description	Run chaos security engineering tests — AI agent attempts to hack the Sprint output and reports findings to the team

Chaos Security Testing Skill

When to Use

Invoke during or after Sprint development to proactively test the Sprint's output for security weaknesses. The AI agent acts as a "friendly hacker" trying to break the system.

Chaos Security Test Categories

1. Authentication Chaos

Attempt to access endpoints without valid JWT
Try expired/malformed tokens
Test session fixation and hijacking scenarios
Brute force login with rate limiting verification

2. Authorization Chaos

Attempt IDOR: access another user's account by changing IDs
Try privilege escalation: regular user accessing admin endpoints
Test horizontal access: user A accessing user B's transactions

3. Input Chaos

SQL injection payloads on all input fields
XSS payloads in text fields, headers, query params
Command injection via file upload names
Oversized payloads to test input validation limits
Unicode/encoding attacks

4. Data Exposure Chaos

Check error responses for stack traces or internal paths
Verify PII is masked in logs and responses
Test for information leakage in HTTP headers
Check if debug endpoints are exposed

5. Resilience Chaos

Simulate external service timeout (payment gateway, KYC)
Test circuit breaker behavior under load
Verify graceful degradation when database is slow
Test rate limiting under burst traffic

Output Format (for Daily Scrum / Sprint Review)

# Chaos Security Test Report — Sprint [N]

## Tests Executed: [X]
## Vulnerabilities Found: [Y]

| # | Test | Category | Result | Severity | Details |
|---|------|----------|--------|----------|---------|
| 1 | IDOR on /accounts/{id} | AuthZ | FAIL | Critical | Can access other users' accounts |
| 2 | SQL injection on /search | Input | PASS | - | Parameterized queries working |
| 3 | Expired JWT access | AuthN | PASS | - | Returns 401 correctly |

## Recommended Sprint Backlog Items
- [ ] BANK-SEC-XXX: Fix IDOR on account endpoints (P0)

Plus depuis ce dépôt

même dépôt

code-standards

timwukp/Kiro-SDLC-Scrum-best-practics

Validate Java and TypeScript code against banking naming conventions, style rules, quality standards, and secure coding practices

2026-05-177

security-audit

timwukp/Kiro-SDLC-Scrum-best-practics

Perform OWASP Top 10 security assessments, vulnerability scanning, and PCI-DSS compliance checks

2026-05-177

test-strategy

timwukp/Kiro-SDLC-Scrum-best-practics

Design test strategies including security testing, write test plans, and identify test scenarios for banking features with DevSecOps integration

2026-05-177

threat-modeling

timwukp/Kiro-SDLC-Scrum-best-practics

Perform STRIDE threat modeling during Sprint Planning for new features and APIs

2026-05-177

ux-review

timwukp/Kiro-SDLC-Scrum-best-practics

Run UX review checklist for banking user flows, validate WCAG accessibility compliance, assess security UX patterns, and review customer interface design

2026-05-177

api-contract

timwukp/Kiro-SDLC-Scrum-best-practics

Design, review, and validate API contracts and OpenAPI specifications for banking services

2026-03-297

Chaos Security Testing Skill

When to Use

Invoke during or after Sprint development to proactively test the Sprint's output for security weaknesses. The AI agent acts as a "friendly hacker" trying to break the system.

Chaos Security Test Categories

1. Authentication Chaos

Attempt to access endpoints without valid JWT

Try expired/malformed tokens

Test session fixation and hijacking scenarios

Brute force login with rate limiting verification

2. Authorization Chaos

Attempt IDOR: access another user's account by changing IDs

Try privilege escalation: regular user accessing admin endpoints

Test horizontal access: user A accessing user B's transactions

3. Input Chaos

SQL injection payloads on all input fields

XSS payloads in text fields, headers, query params

Command injection via file upload names

Oversized payloads to test input validation limits

Unicode/encoding attacks

4. Data Exposure Chaos

Check error responses for stack traces or internal paths

Verify PII is masked in logs and responses

Test for information leakage in HTTP headers

Check if debug endpoints are exposed

5. Resilience Chaos

Simulate external service timeout (payment gateway, KYC)

Test circuit breaker behavior under load

Verify graceful degradation when database is slow

Test rate limiting under burst traffic

Output Format (for Daily Scrum / Sprint Review)

# Chaos Security Test Report — Sprint [N] ## Tests Executed: [X] ## Vulnerabilities Found: [Y] | # | Test | Category | Result | Severity | Details | |---|------|----------|--------|----------|---------| | 1 | IDOR on /accounts/{id} | AuthZ | FAIL | Critical | Can access other users' accounts | | 2 | SQL injection on /search | Input | PASS | - | Parameterized queries working | | 3 | Expired JWT access | AuthN | PASS | - | Returns 401 correctly | ## Recommended Sprint Backlog Items - [ ] BANK-SEC-XXX: Fix IDOR on account endpoints (P0)