# QA Security Test Writer

> Generate security tests based on OWASP Top 10 and WSTG covering injection, XSS, CSRF, authentication bypass, and DAST using ZAP and custom scripts.

- Skill: `azanir/qa-security-test-writer` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add azanir/qa-security-test-writer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/azanir/qa-security-test-writer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: azanir (https://skillmd.com/u/azanir)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/azanir/qa-security-test-writer

---


# QA Security Test Writer

## Purpose

Write security tests covering OWASP Top 10 vulnerabilities and OWASP WSTG scenarios. Transform NFR security requirements (from qa-nfr-analyst) and application context into executable security test scripts (TypeScript/Python), OWASP ZAP configurations, and vulnerability reports. Support both custom script-based testing and DAST (Dynamic Application Security Testing) via ZAP.

## Trigger Phrases

- "Write security tests for [app/API]"
- "Generate OWASP Top 10 tests"
- "Create ZAP configuration for [target]"
- "Security tests for SQL injection, XSS, CSRF"
- "DAST scan setup with OWASP ZAP"
- "Authentication bypass tests"
- "Security test scripts from NFR analysis"
- "OWASP WSTG test scenarios"

## OWASP Top 10 Coverage

| ID | Category | Test Focus |
|----|----------|------------|
| **A01** | Broken Access Control | IDOR, privilege escalation, path traversal, CORS |
| **A02** | Cryptographic Failures | TLS, weak hashing, sensitive data in transit/rest |
| **A03** | Injection | SQL, NoSQL, OS command, LDAP, XPath, SSTI |
| **A04** | Insecure Design | Business logic flaws, missing security controls |
| **A05** | Security Misconfiguration | Default creds, debug mode, verbose errors, headers |
| **A06** | Vulnerable Components | Dependency scanning, known CVEs |
| **A07** | Identification/Authentication Failures | Weak passwords, session fixation, credential stuffing |
| **A08** | Software/Data Integrity Failures | Unsigned updates, deserialization, CI/CD tampering |
| **A09** | Security Logging/Monitoring Failures | Missing audit logs, insufficient alerting |
| **A10** | Server-Side Request Forgery | SSRF to internal services, cloud metadata |

See `references/owasp-top10.md` for test scenarios and example code per category.

## Tools

| Tool | Purpose |
|------|---------|
| **OWASP ZAP** | DAST scanning, passive/active scan, API scan, authentication |
| **Custom TypeScript** | Supertest/httpx-style API security tests, Playwright for auth flows |
| **Custom Python** | httpx/requests API tests, pytest-based security checks |
| **Playwright** | Authentication bypass, session management, XSS verification |

## Workflow

1. **Read NFR analysis** — From qa-nfr-analyst; extract security criteria and OWASP WSTG baseline
2. **Map OWASP WSTG scenarios** — Align requirements to WSTG test IDs (see qa-nfr-analyst `references/owasp-wstg-baseline.md`)
3. **Generate security test scripts** — TypeScript (Supertest/Playwright) or Python (httpx/pytest)
4. **Configure ZAP** — Active/passive scan, auth, policies (see `references/zap-config.md`)
5. **Run DAST scan** — Execute ZAP; produce vulnerability report

## Test Categories

| Category | Techniques | Tools |
|----------|-------------|-------|
| **SQL Injection** | Union-based, error-based, blind, time-based | Custom scripts, ZAP |
| **XSS** | Reflected, stored, DOM-based | Custom scripts, Playwright, ZAP |
| **CSRF** | Missing token, token reuse, SameSite | Custom scripts, Playwright |
| **Authentication bypass** | Direct access, token manipulation, session fixation | Playwright, Supertest/httpx |
| **Session management** | Timeout, logout, cookie attributes | Custom scripts |
| **Header security** | HSTS, X-Frame-Options, CSP, X-Content-Type-Options | Custom scripts, ZAP |
| **CORS misconfiguration** | Wildcard origin, credential leakage | Custom scripts |
| **File upload** | Extension bypass, content-type spoofing, path traversal | Custom scripts |

## Output

- **Security test scripts** — `tests/security/` or `tests/security/` with TS/Python files
- **ZAP configuration** — `zap-config.yaml` or `.zap/config` for automation
- **Vulnerability report** — Summary of findings with severity, evidence, remediation

## References

- `references/owasp-top10.md` — OWASP Top 10 test scenarios with example test code
- `references/zap-config.md` — OWASP ZAP configuration (active/passive scan, API, auth, policies)
- `references/best-practices.md` — Safe testing, test environments, reporting, remediation

## Scope

**Can do (autonomous):**
- Generate security test scripts from NFR analysis or WSTG scenarios
- Create ZAP configuration for DAST
- Write custom TypeScript/Python tests for injection, XSS, CSRF, auth, headers
- Map OWASP Top 10 to test cases
- Call qa-nfr-analyst for security NFRs when needed
- Use qa-diagram-generator for threat/attack flow diagrams

**Cannot do (requires confirmation):**
- Run scans against production without explicit approval
- Add dependencies not in package.json/requirements.txt
- Override project security policy or scope

**Will not do (out of scope):**
- Execute ZAP or custom tests (user runs them)
- Perform penetration testing beyond automated checks
- Implement security fixes

## Quality Checklist

- [ ] Tests cover OWASP Top 10 categories relevant to the application
- [ ] No hardcoded credentials; use env vars or fixtures
- [ ] Payloads are safe (no destructive SQL/commands)
- [ ] ZAP config targets staging/test environment only
- [ ] Each test has clear assertion (pass = no vulnerability)
- [ ] File naming follows `test_*_security.ts` or `test_*_security.py`
- [ ] References to NFR IDs or WSTG IDs where applicable
- [ ] Vulnerability report includes severity and remediation guidance

## Troubleshooting

| Symptom | Likely Cause | Fix |
|---------|--------------|-----|
| ZAP scan finds nothing | Target not reachable, auth not configured | Verify base URL; configure ZAP authentication |
| Tests fail with 403 | WAF or rate limiting | Use test env; whitelist test IP; reduce concurrency |
| False positives in ZAP | Aggressive policy, app-specific behavior | Tune scan policy; add context/exclusions |
| XSS payload not reflected | Input sanitization, encoding | Try alternative payloads; check DOM sinks |
| CSRF test passes incorrectly | SameSite=Lax blocks cross-site POST | Use same-origin test or disable SameSite in test |
| Session tests flaky | Short timeout, shared state | Increase timeout; isolate session per test |