Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
Instruções da origem · Visualização somente leitura
name
security-pen-testing
description
Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation.
Hands-on offensive security testing skill for finding vulnerabilities before attackers do. This is NOT compliance checking (see senior-secops) or security policy writing (see senior-security) — this is about systematic vulnerability discovery through authorized testing.
This skill provides the methodology, checklists, and automation for offensive security testing — actively probing systems to discover exploitable vulnerabilities. It covers web applications, APIs, infrastructure, and supply chain security.
Distinction from Other Security Skills
Skill
Focus
Approach
security-pen-testing (this)
Finding vulnerabilities
Offensive — simulate attacker techniques
senior-secops
Security operations
Defensive — monitoring, incident response, SIEM
senior-security
Security policy
Governance — policies, frameworks, risk registers
skill-security-auditor
CI/CD gates
Automated — pre-merge security checks
Prerequisites
All testing described here assumes written authorization from the system owner. Unauthorized testing is illegal under the CFAA and equivalent laws worldwide. Always obtain a signed scope-of-work or rules-of-engagement document before starting.
OWASP Top 10 Systematic Audit
Use the vulnerability scanner tool for automated checklist generation:
# Generate OWASP checklist for a web application
python scripts/vulnerability_scanner.py --target web --scope full
# Quick API-focused scan
python scripts/vulnerability_scanner.py --target api --scope quick --json
Tools: TruffleHog (git history + filesystem), Gitleaks (regex-based with custom rules).
# Scan git history for verified secrets
trufflehog git file://. --only-verified --json
# Scan filesystem
trufflehog filesystem . --json
Integration points: Pre-commit hooks (gitleaks, trufflehog), CI/CD gates (GitHub Actions with trufflesecurity/trufflehog@main). Configure .gitleaks.toml for custom rules (AWS keys, API keys, private key headers) and allowlists for test fixtures.
See attack_patterns.md for complete test payloads (XSS filter bypasses, context-specific XSS, SQL injection per database engine, SSRF bypass techniques, and DOM-based XSS source/sink pairs).
Infrastructure Security
Key checks:
Cloud storage: S3 bucket public access (aws s3 ls s3://bucket --no-sign-request), bucket policies, ACLs
HTTP security headers: HSTS, CSP (no unsafe-inline/unsafe-eval), X-Content-Type-Options, X-Frame-Options, Referrer-Policy
[{"title":"SQL Injection in Login Endpoint","severity":"critical","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","category":"A03:2021 - Injection","description":"The /api/login endpoint is vulnerable to SQL injection via the email parameter.","evidence":"Request: POST /api/login {\"email\": \"' OR 1=1--\", \"password\": \"x\"}\nResponse: 200 OK with admin session token","impact":"Full database access, authentication bypass, potential remote code execution","remediation":"Use parameterized queries. Replace string concatenation with prepared statements.","references":["https://cwe.mitre.org/data/definitions/89.html"]}]
Report Structure
Executive Summary: Business impact, overall risk level, top 3 findings
Scope: What was tested, what was excluded, testing dates
Findings Table: Sorted by severity with CVSS scores
Detailed Findings: Each with description, evidence, impact, remediation
Remediation Priority Matrix: Effort vs. impact for each fix
Appendix: Raw tool output, full payload lists
Responsible Disclosure Workflow
Responsible disclosure is mandatory for any vulnerability found during authorized testing. Standard timeline: report on day 1, follow up at day 7, status update at day 30, public disclosure at day 90.
Key principles: Never exploit beyond proof of concept, encrypt all communications, do not access real user data, document everything with timestamps.
See responsible_disclosure.md for full disclosure timelines (standard 90-day, accelerated 30-day, extended 120-day), communication templates, legal considerations, bug bounty program integration, and CVE request process.
Workflows
Workflow 1: Quick Security Check (15 Minutes)
For pre-merge reviews or quick health checks:
# 1. Generate OWASP checklist
python scripts/vulnerability_scanner.py --target web --scope quick
# 2. Scan dependencies
python scripts/dependency_auditor.py --file package.json --severity high
# 3. Check for secrets in recent commits# (Use gitleaks or trufflehog as described in Secret Scanning section)# 4. Review HTTP security headers
curl -sI https://target.com | grep -iE "(strict-transport|content-security|x-frame|x-content-type)"
Decision: If any critical or high findings, block the merge.
Workflow 2: Full Penetration Test (Multi-Day Assessment)
Day 1 — Reconnaissance:
Map the attack surface: endpoints, authentication flows, third-party integrations
Run automated OWASP checklist (full scope)
Run dependency audit across all manifests
Run secret scan on full git history
Day 2 — Manual Testing:
Test authentication and authorization (IDOR, BOLA, BFLA)
Test injection points (SQLi, XSS, SSRF, command injection)
Test business logic flaws
Test API-specific vulnerabilities (GraphQL, rate limiting, mass assignment)
