How do I install the Top Web Vulnerabilities skill?

Run npx skillmds@latest add francostino/top-web-vulnerabilities in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Top Web Vulnerabilities safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Top Web Vulnerabilities?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Top Web Vulnerabilities free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Top Web Vulnerabilities?

FrancoStino (@francostino) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Top Web Vulnerabilities by francostino

Name: Top Web Vulnerabilities
Rating: 4.2 (5 reviews)
Author: FrancoStino

Top Web Vulnerabilities

Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.

FrancoStino Updated Sep 8, 2026 63 repo stars

File contents

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

Ask the user to state the exact target URL, IP, account, or resource.

Ask the user to confirm written authorization and the permitted scope.

Show the exact command(s) and explain their expected effect.

Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Top 100 Web Vulnerabilities Reference

Detailed Guide

Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.

Prerequisites

Basic understanding of web application architecture (client-server model, HTTP protocol)
Familiarity with common web technologies (HTML, JavaScript, SQL, XML, APIs)
Understanding of authentication and authorization concepts
Access to web application security testing tools (Burp Suite, OWASP ZAP)
Knowledge of secure coding principles recommended

Constraints and Limitations

Vulnerability definitions represent common patterns; specific implementations vary
Mitigations must be adapted to technology stack and architecture
New vulnerabilities emerge continuously; reference should be updated
Some vulnerabilities overlap across categories (e.g., IDOR appears in multiple contexts)
Effectiveness of mitigations depends on proper implementation
Automated scanners cannot detect all vulnerability types (especially business logic)

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

---name: top-web-vulnerabilitiesdescription: Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.---> **⚠️ AUTHORIZED USE ONLY**> This skill is for educational purposes or authorized security assessments only.> You must have explicit, written permission from the system owner before using this tool.> Misuse of this tool is illegal and strictly prohibited.> **Mandatory confirmation gate**> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:> 1. Ask the user to state the exact target URL, IP, account, or resource.> 2. Ask the user to confirm written authorization and the permitted scope.> 3. Show the exact command(s) and explain their expected effect.> 4. Wait for explicit confirmation in the current conversation.>> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.# Top 100 Web Vulnerabilities Reference## Detailed GuideRead [the detailed guide](references/detailed-guide.md) before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.## Prerequisites- Basic understanding of web application architecture (client-server model, HTTP protocol)- Familiarity with common web technologies (HTML, JavaScript, SQL, XML, APIs)- Understanding of authentication and authorization concepts- Access to web application security testing tools (Burp Suite, OWASP ZAP)- Knowledge of secure coding principles recommended## Constraints and Limitations- Vulnerability definitions represent common patterns; specific implementations vary- Mitigations must be adapted to technology stack and architecture- New vulnerabilities emerge continuously; reference should be updated- Some vulnerabilities overlap across categories (e.g., IDOR appears in multiple contexts)- Effectiveness of mitigations depends on proper implementation- Automated scanners cannot detect all vulnerability types (especially business logic)---## When to UseThis skill is applicable to execute the workflow or actions described in the overview.

Frequently asked questions