Menu
Testing dinámico de endpoints web: XSS (DalFox), SQLi (sqlmap), Nuclei.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
Detecta el Bus Factor por modulo en un repositorio git usando el algoritmo CST(change-size-ratio). Genera JSON con BF, owners, riesgo, y avisa cuando un solo dev conoce un modulo critico.
Genera CONTEXT_DOME.md para modulos con Bus Factor bajo. Captura conocimiento tacito: proposito, decisiones no obvias, dependencias, runbook minimo, knowledge owners y plan de distribucion.
Usar cuando se quiere ejecutar tareas de bajo riesgo de forma autónoma durante la noche.
Mapear la superficie de ataque de un dominio: subdominios, OSINT, typosquatting.
| name | dynamic-web-tester |
| description | Testing dinámico de endpoints web: XSS (DalFox), SQLi (sqlmap), Nuclei. |
| summary | Testing dinamico controlado contra endpoints web en staging. REQUIERE autorizacion explicita. Modo conservador por defecto (level 1, safe). Complementa pentesting skill con deteccion activa de XSS y SQLi. |
| maturity | stable |
| context | fork |
| context_cost | medium |
| category | security |
| tags | ["xss","sqli","dalfox","sqlmap","nuclei","pentest-web","dynamic-testing"] |
| priority | high |
| authorization_required | true |
Este skill ejecuta herramientas de testing activo contra endpoints HTTP. Nunca ejecutar contra producción directamente. Requiere autorización escrita del propietario.
1. Verificar autorización → output/security/authorization-{host}.txt
2. DalFox — XSS scanning (reflected, DOM, stored)
3. sqlmap — SQL injection (level 1 risk 1 batch — conservador)
4. Nuclei — templates web: xss, sqli, lfi
5. Report → output/security/dynamic-test-{host}-YYYYMMDD.json
# Crear autorización primero
echo "AUTHORIZED" > output/security/authorization-localhost.txt
# Ejecutar en modo seguro (default)
bash scripts/dynamic-web-security-test.sh \
--target http://localhost:8080 \
--tools xss,sqli,nuclei \
--safe
| Herramienta | Imagen Docker | Función |
|---|---|---|
| DalFox | ghcr.io/hahwul/dalfox:latest | XSS detection |
| sqlmap | paoloo/sqlmap | SQL injection |
| Nuclei | projectdiscovery/nuclei | CVE/web templates |
--level 1 --risk 1 --batch — sin payloads destructivos--silence — solo findingsoutput/security/
authorization-{host}.txt
dynamic-test-{host}-YYYYMMDD.json ← report consolidado
dynamic-test-{host}-YYYYMMDD/
dalfox-results.json
sqlmap/
nuclei-results.json
nuclei-scanning skill (CVEs de tech stack)Sin output/security/authorization-{host}.txt con "AUTHORIZED" y < 30 días,
el script aborta con exit 1.