chaos-security-testing

Estrelas7

Forks5

Atualizado17 de maio de 2026 às 06:37

Run chaos security engineering tests — AI agent attempts to hack the Sprint output and reports findings to the team

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Fonte

timwukp

timwukp/Kiro-SDLC-Scrum-best-practics

Abrir repositório GitHub Ver repositórios do creator

Download

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

Explorador de arquivos

2 arquivos

SKILL.md

readonly

name	chaos-security-testing
description	Run chaos security engineering tests — AI agent attempts to hack the Sprint output and reports findings to the team

Chaos Security Testing Skill

When to Use

Invoke during or after Sprint development to proactively test the Sprint's output for security weaknesses. The AI agent acts as a "friendly hacker" trying to break the system.

Chaos Security Test Categories

1. Authentication Chaos

Attempt to access endpoints without valid JWT
Try expired/malformed tokens
Test session fixation and hijacking scenarios
Brute force login with rate limiting verification

2. Authorization Chaos

Attempt IDOR: access another user's account by changing IDs
Try privilege escalation: regular user accessing admin endpoints
Test horizontal access: user A accessing user B's transactions

3. Input Chaos

SQL injection payloads on all input fields
XSS payloads in text fields, headers, query params
Command injection via file upload names
Oversized payloads to test input validation limits
Unicode/encoding attacks

4. Data Exposure Chaos

Check error responses for stack traces or internal paths
Verify PII is masked in logs and responses
Test for information leakage in HTTP headers
Check if debug endpoints are exposed

5. Resilience Chaos

Simulate external service timeout (payment gateway, KYC)
Test circuit breaker behavior under load
Verify graceful degradation when database is slow
Test rate limiting under burst traffic

Output Format (for Daily Scrum / Sprint Review)

# Chaos Security Test Report — Sprint [N]

## Tests Executed: [X]
## Vulnerabilities Found: [Y]

| # | Test | Category | Result | Severity | Details |
|---|------|----------|--------|----------|---------|
| 1 | IDOR on /accounts/{id} | AuthZ | FAIL | Critical | Can access other users' accounts |
| 2 | SQL injection on /search | Input | PASS | - | Parameterized queries working |
| 3 | Expired JWT access | AuthN | PASS | - | Returns 401 correctly |

## Recommended Sprint Backlog Items
- [ ] BANK-SEC-XXX: Fix IDOR on account endpoints (P0)

Mais deste repositório

mesmo repositório

code-standards

timwukp/Kiro-SDLC-Scrum-best-practics

Validate Java and TypeScript code against banking naming conventions, style rules, quality standards, and secure coding practices

2026-05-177

security-audit

timwukp/Kiro-SDLC-Scrum-best-practics

Perform OWASP Top 10 security assessments, vulnerability scanning, and PCI-DSS compliance checks

2026-05-177

test-strategy

timwukp/Kiro-SDLC-Scrum-best-practics

Design test strategies including security testing, write test plans, and identify test scenarios for banking features with DevSecOps integration

2026-05-177

threat-modeling

timwukp/Kiro-SDLC-Scrum-best-practics

Perform STRIDE threat modeling during Sprint Planning for new features and APIs

2026-05-177

ux-review

timwukp/Kiro-SDLC-Scrum-best-practics

Run UX review checklist for banking user flows, validate WCAG accessibility compliance, assess security UX patterns, and review customer interface design

2026-05-177

api-contract

timwukp/Kiro-SDLC-Scrum-best-practics

Design, review, and validate API contracts and OpenAPI specifications for banking services

2026-03-297

Chaos Security Testing Skill

When to Use

Invoke during or after Sprint development to proactively test the Sprint's output for security weaknesses. The AI agent acts as a "friendly hacker" trying to break the system.

Chaos Security Test Categories

1. Authentication Chaos

Attempt to access endpoints without valid JWT

Try expired/malformed tokens

Test session fixation and hijacking scenarios

Brute force login with rate limiting verification

2. Authorization Chaos

Attempt IDOR: access another user's account by changing IDs

Try privilege escalation: regular user accessing admin endpoints

Test horizontal access: user A accessing user B's transactions

3. Input Chaos

SQL injection payloads on all input fields

XSS payloads in text fields, headers, query params

Command injection via file upload names

Oversized payloads to test input validation limits

Unicode/encoding attacks

4. Data Exposure Chaos

Check error responses for stack traces or internal paths

Verify PII is masked in logs and responses

Test for information leakage in HTTP headers

Check if debug endpoints are exposed

5. Resilience Chaos

Simulate external service timeout (payment gateway, KYC)

Test circuit breaker behavior under load

Verify graceful degradation when database is slow

Test rate limiting under burst traffic

Output Format (for Daily Scrum / Sprint Review)

# Chaos Security Test Report — Sprint [N] ## Tests Executed: [X] ## Vulnerabilities Found: [Y] | # | Test | Category | Result | Severity | Details | |---|------|----------|--------|----------|---------| | 1 | IDOR on /accounts/{id} | AuthZ | FAIL | Critical | Can access other users' accounts | | 2 | SQL injection on /search | Input | PASS | - | Parameterized queries working | | 3 | Expired JWT access | AuthN | PASS | - | Returns 401 correctly | ## Recommended Sprint Backlog Items - [ ] BANK-SEC-XXX: Fix IDOR on account endpoints (P0)