Customization
Before executing, check for user customizations at:
~/.claude/PAI/USER/SKILLCUSTOMIZATIONS/WebAssessment/
If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.
- Output text notification:
Running the **WorkflowName** workflow in the **WebAssessment** skill to ACTION...
This is not optional. Execute this curl command immediately upon skill invocation.
WebAssessment Skill
Security assessment infrastructure integrating reconnaissance, threat modeling, and vulnerability testing.
Workflow Routing
| Trigger |
Workflow |
| "understand application", "what does this app do", "map the application" |
UnderstandApplication |
| "threat model", "attack scenarios", "how would I attack" |
CreateThreatModel |
| "pentest", "security assessment", "test for vulnerabilities" |
Pentest/MasterMethodology |
| "fuzz with ffuf", "directory fuzzing", "content discovery" |
ffuf/FfufGuide |
| "OSINT", "reconnaissance", "open source intelligence" |
osint/MasterGuide |
| "test web app", "Playwright", "browser automation" |
webapp/TestingGuide |
| "bug bounty", "bounty programs" |
bug-bounty/Programs |
| "vulnerability analysis with AI", "Gemini analysis" |
VulnerabilityAnalysisGemini3 |
Skill Integration
WebAssessment coordinates with specialized skills:
| Phase |
Skill |
Purpose |
| Scope Definition |
Recon |
Corporate structure, domain enumeration |
| Target Discovery |
Recon |
Subdomains, endpoints, ports |
| Understanding |
WebAssessment |
App narrative, user flows, sensitive data |
| Threat Modeling |
WebAssessment |
Attack scenarios, test prioritization |
| Injection Testing |
PromptInjection |
LLM-specific attacks |
| Intelligence |
OSINT |
People, companies, social media |
Assessment Workflow
1. Corporate Structure (Recon) → Define scope and targets
2. Subdomain Enumeration (Recon) → Find all domains
3. Endpoint Discovery (Recon) → Extract JS endpoints
4. Understand Application → Build app narrative
5. Create Threat Model → Prioritize attack scenarios
6. Execute Testing → Test against identified threats
7. Report Findings → Document with PoCs
Recon Skill Tools
WebAssessment uses tools from the Recon skill:
# Corporate structure for scope
bun ~/.claude/skills/Security/Recon/Tools/CorporateStructure.ts target.com
# Subdomain enumeration
bun ~/.claude/skills/Security/Recon/Tools/SubdomainEnum.ts target.com
# Endpoint discovery from JavaScript
bun ~/.claude/skills/Security/Recon/Tools/EndpointDiscovery.ts https://target.com
# Port scanning
bun ~/.claude/skills/Security/Recon/Tools/PortScan.ts target.com
# Path discovery
bun ~/.claude/skills/Security/Recon/Tools/PathDiscovery.ts https://target.com
UnderstandApplication Output
Produces structured narrative including:
- Summary: Purpose, industry, user base, critical functions
- User Roles: Access levels and capabilities
- User Flows: Step-by-step processes with sensitive data
- Technology Stack: Frontend, backend, auth, third-party
- Attack Surface: Entry points, inputs, file uploads, websockets
CreateThreatModel Output
Generates prioritized attack plan:
- Threats: OWASP/CWE mapped with risk scores
- Attack Paths: Multi-step attack scenarios
- Test Plan: Prioritized with tool suggestions
- Effort Estimates: Quick/medium/extensive per threat
Threat Categories
| Category |
Triggers On |
| Authentication |
Auth mechanisms detected |
| Access Control |
Multiple user roles |
| Injection |
All web apps |
| Data Exposure |
Sensitive data identified |
| File Upload |
Upload functionality |
| API Security |
API endpoints |
| WebSocket |
WebSocket detected |
| Business Logic |
All web apps |
| Payment Security |
Payment flows |
6-Phase Pentest Methodology
Phase 0: Scoping & Preparation
Phase 1: Reconnaissance (Recon skill)
Phase 2: Mapping (content discovery)
Phase 3: Vulnerability Analysis
Phase 4: Exploitation
Phase 5: Reporting
Key Principles
- Authorization first - Never test without explicit permission
- Understand before testing - Build app narrative first
- Threat model guides testing - Don't test blindly
- Breadth then depth - Wide recon, focused exploitation
- Document everything - Notes, screenshots, commands
Workflow Index
Core Assessment:
Workflows/UnderstandApplication.md - Application reconnaissanceWorkflows/CreateThreatModel.md - Attack scenario generation
Penetration Testing:
Workflows/pentest/MasterMethodology.md - 6-phase methodologyWorkflows/pentest/ToolInventory.md - Security tools referenceWorkflows/pentest/Reconnaissance.md - Asset discoveryWorkflows/pentest/Exploitation.md - Vulnerability testing
Web Fuzzing:
Workflows/ffuf/FfufGuide.md - FFUF fuzzing guideWorkflows/ffuf/FfufHelper.md - Automated fuzzing helper
Bug Bounty:
Workflows/bug-bounty/Programs.md - Program trackingWorkflows/bug-bounty/AutomationTool.md - Bounty automation
Web App Testing:
Workflows/webapp/TestingGuide.md - Playwright testingWorkflows/webapp/Examples.md - Testing patterns
OSINT:
Workflows/osint/MasterGuide.md - OSINT methodologyWorkflows/osint/Reconnaissance.md - Domain reconWorkflows/osint/SocialMediaIntel.md - SOCMINTWorkflows/osint/Automation.md - SpiderFoot/MaltegoWorkflows/osint/MetadataAnalysis.md - ExifTool analysis
AI-Powered:
Workflows/VulnerabilityAnalysisGemini3.md - Gemini deep analysis
Examples
Example 1: Full assessment workflow
User: "Security assessment on app.example.com"
→ Run UnderstandApplication to build narrative
→ Run CreateThreatModel to prioritize testing
→ Follow MasterMethodology with threat model guidance
→ Report findings with OWASP/CWE references
Example 2: Quick threat model
User: "How would I attack this app?"
→ Run CreateThreatModel on target
→ Get prioritized attack paths
→ Get test plan with tool suggestions
Example 3: Integrate with Recon
User: "Assessment on target.com including all subdomains"
→ CorporateStructure (Recon) → Find parent/child companies
→ SubdomainEnum (Recon) → Find all subdomains
→ EndpointDiscovery (Recon) → Extract JS endpoints
→ UnderstandApplication → Build app narrative
→ CreateThreatModel → Generate attack plan
1---2name: webassessment-23description: Full web app security assessment — app understanding, threat modeling, OWASP testing, ffuf fuzzing, Playwright automation, AI-assisted vuln analysis. Coordinates with Recon and PromptInjection skills. USE WHEN web assessment, pentest, security testing, vulnerability scan, threat model app, understand application, create threat model, vulnerability analysis, Gemini analysis, ffuf, fuzzing, bug bounty, OSINT, browser automation, Playwright.4---56## Customization78**Before executing, check for user customizations at:**9`~/.claude/PAI/USER/SKILLCUSTOMIZATIONS/WebAssessment/`1011If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.12132. **Output text notification**:14 ```15 Running the **WorkflowName** workflow in the **WebAssessment** skill to ACTION...16 ```1718**This is not optional. Execute this curl command immediately upon skill invocation.**1920# WebAssessment Skill2122Security assessment infrastructure integrating reconnaissance, threat modeling, and vulnerability testing.2324## Workflow Routing2526| Trigger | Workflow |27|---------|----------|28| "understand application", "what does this app do", "map the application" | UnderstandApplication |29| "threat model", "attack scenarios", "how would I attack" | CreateThreatModel |30| "pentest", "security assessment", "test for vulnerabilities" | Pentest/MasterMethodology |31| "fuzz with ffuf", "directory fuzzing", "content discovery" | ffuf/FfufGuide |32| "OSINT", "reconnaissance", "open source intelligence" | osint/MasterGuide |33| "test web app", "Playwright", "browser automation" | webapp/TestingGuide |34| "bug bounty", "bounty programs" | bug-bounty/Programs |35| "vulnerability analysis with AI", "Gemini analysis" | VulnerabilityAnalysisGemini3 |3637## Skill Integration3839WebAssessment coordinates with specialized skills:4041| Phase | Skill | Purpose |42|-------|-------|---------|43| Scope Definition | **Recon** | Corporate structure, domain enumeration |44| Target Discovery | **Recon** | Subdomains, endpoints, ports |45| Understanding | **WebAssessment** | App narrative, user flows, sensitive data |46| Threat Modeling | **WebAssessment** | Attack scenarios, test prioritization |47| Injection Testing | **PromptInjection** | LLM-specific attacks |48| Intelligence | **OSINT** | People, companies, social media |4950## Assessment Workflow5152```531. Corporate Structure (Recon) → Define scope and targets542. Subdomain Enumeration (Recon) → Find all domains553. Endpoint Discovery (Recon) → Extract JS endpoints564. Understand Application → Build app narrative575. Create Threat Model → Prioritize attack scenarios586. Execute Testing → Test against identified threats597. Report Findings → Document with PoCs60```6162## Recon Skill Tools6364WebAssessment uses tools from the Recon skill:6566```bash67# Corporate structure for scope68bun ~/.claude/skills/Security/Recon/Tools/CorporateStructure.ts target.com6970# Subdomain enumeration71bun ~/.claude/skills/Security/Recon/Tools/SubdomainEnum.ts target.com7273# Endpoint discovery from JavaScript74bun ~/.claude/skills/Security/Recon/Tools/EndpointDiscovery.ts https://target.com7576# Port scanning77bun ~/.claude/skills/Security/Recon/Tools/PortScan.ts target.com7879# Path discovery80bun ~/.claude/skills/Security/Recon/Tools/PathDiscovery.ts https://target.com81```8283## UnderstandApplication Output8485Produces structured narrative including:86- **Summary**: Purpose, industry, user base, critical functions87- **User Roles**: Access levels and capabilities88- **User Flows**: Step-by-step processes with sensitive data89- **Technology Stack**: Frontend, backend, auth, third-party90- **Attack Surface**: Entry points, inputs, file uploads, websockets9192## CreateThreatModel Output9394Generates prioritized attack plan:95- **Threats**: OWASP/CWE mapped with risk scores96- **Attack Paths**: Multi-step attack scenarios97- **Test Plan**: Prioritized with tool suggestions98- **Effort Estimates**: Quick/medium/extensive per threat99100## Threat Categories101102| Category | Triggers On |103|----------|-------------|104| Authentication | Auth mechanisms detected |105| Access Control | Multiple user roles |106| Injection | All web apps |107| Data Exposure | Sensitive data identified |108| File Upload | Upload functionality |109| API Security | API endpoints |110| WebSocket | WebSocket detected |111| Business Logic | All web apps |112| Payment Security | Payment flows |113114## 6-Phase Pentest Methodology115116**Phase 0**: Scoping & Preparation117**Phase 1**: Reconnaissance (Recon skill)118**Phase 2**: Mapping (content discovery)119**Phase 3**: Vulnerability Analysis120**Phase 4**: Exploitation121**Phase 5**: Reporting122123## Key Principles1241251. **Authorization first** - Never test without explicit permission1262. **Understand before testing** - Build app narrative first1273. **Threat model guides testing** - Don't test blindly1284. **Breadth then depth** - Wide recon, focused exploitation1295. **Document everything** - Notes, screenshots, commands130131## Workflow Index132133**Core Assessment:**134- `Workflows/UnderstandApplication.md` - Application reconnaissance135- `Workflows/CreateThreatModel.md` - Attack scenario generation136137**Penetration Testing:**138- `Workflows/pentest/MasterMethodology.md` - 6-phase methodology139- `Workflows/pentest/ToolInventory.md` - Security tools reference140- `Workflows/pentest/Reconnaissance.md` - Asset discovery141- `Workflows/pentest/Exploitation.md` - Vulnerability testing142143**Web Fuzzing:**144- `Workflows/ffuf/FfufGuide.md` - FFUF fuzzing guide145- `Workflows/ffuf/FfufHelper.md` - Automated fuzzing helper146147**Bug Bounty:**148- `Workflows/bug-bounty/Programs.md` - Program tracking149- `Workflows/bug-bounty/AutomationTool.md` - Bounty automation150151**Web App Testing:**152- `Workflows/webapp/TestingGuide.md` - Playwright testing153- `Workflows/webapp/Examples.md` - Testing patterns154155**OSINT:**156- `Workflows/osint/MasterGuide.md` - OSINT methodology157- `Workflows/osint/Reconnaissance.md` - Domain recon158- `Workflows/osint/SocialMediaIntel.md` - SOCMINT159- `Workflows/osint/Automation.md` - SpiderFoot/Maltego160- `Workflows/osint/MetadataAnalysis.md` - ExifTool analysis161162**AI-Powered:**163- `Workflows/VulnerabilityAnalysisGemini3.md` - Gemini deep analysis164165## Examples166167**Example 1: Full assessment workflow**168```169User: "Security assessment on app.example.com"170→ Run UnderstandApplication to build narrative171→ Run CreateThreatModel to prioritize testing172→ Follow MasterMethodology with threat model guidance173→ Report findings with OWASP/CWE references174```175176**Example 2: Quick threat model**177```178User: "How would I attack this app?"179→ Run CreateThreatModel on target180→ Get prioritized attack paths181→ Get test plan with tool suggestions182```183184**Example 3: Integrate with Recon**185```186User: "Assessment on target.com including all subdomains"187→ CorporateStructure (Recon) → Find parent/child companies188→ SubdomainEnum (Recon) → Find all subdomains189→ EndpointDiscovery (Recon) → Extract JS endpoints190→ UnderstandApplication → Build app narrative191→ CreateThreatModel → Generate attack plan192```
kai-cli