# Web Application Baseline

> Perform an authorized passive web baseline covering headers, cookies, CORS, metadata, sensitive paths, and API signals. Use it before active testing or code changes against an Internet-facing application.

- Skill: `0xcryptj/web-application-baseline` (Agent Skill)
- Install (CLI): `npx skillmds@latest add 0xcryptj/web-application-baseline`
- Raw SKILL.md: https://api.skillmd.com/api/skills/0xcryptj/web-application-baseline/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: 0xcryptj (https://skillmd.com/u/0xcryptj)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/0xcryptj/web-application-baseline

---


# Web Application Baseline

## When to Use

Use this capability when reviewing an authorized website or staging service and you need bounded, low-impact evidence before deciding whether deeper active validation is justified.

## Prerequisites

- Written authorization for the target.
- A reachable HTTP(S) URL.
- A clear rule of engagement for any optional active testing.

## Workflow

1. Run `./agentsec web https://target.example --authorized --baseline-only`.
2. Review headers, cookie attributes, CORS, robots/sitemap, security.txt, and bounded sensitive-path probes.
3. Treat missing controls as review-needed until application and provider configuration are confirmed.
4. Enable `--active` only when explicitly authorized and needed to validate a hypothesis.

## Verification

Confirm the report records the target, authorization mode, baseline observations, raw responses, and any soft-404 handling. Ensure no destructive or credential-testing action was performed.