Customization
Before executing, check for user customizations at:
${PAI_USER_DIR}/SKILLCUSTOMIZATIONS/WebAssessment/
If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.
- Output text notification:
Running the **WorkflowName** workflow in the **WebAssessment** skill to ACTION...
This is not optional. Execute this curl command immediately upon skill invocation.
WebAssessment Skill
Security assessment infrastructure integrating reconnaissance, threat modeling, and vulnerability testing.
Workflow Routing
| Trigger |
Workflow |
| "understand application", "what does this app do", "map the application" |
UnderstandApplication |
| "threat model", "attack scenarios", "how would I attack", "STRIDE analysis", "DREAD scoring", "PASTA threat model" |
CreateThreatModel |
| "pentest", "security assessment", "test for vulnerabilities" |
Pentest/MasterMethodology |
| "fuzz with ffuf", "directory fuzzing", "content discovery" |
ffuf/FfufGuide |
| "OSINT", "reconnaissance", "open source intelligence" |
osint/MasterGuide |
| "test web app", "Playwright", "browser automation" |
webapp/TestingGuide |
| "bug bounty", "bounty programs" |
bug-bounty/Programs |
| "vulnerability analysis with AI", "Gemini analysis" |
VulnerabilityAnalysisGemini3 |
| "security report", "finding template", "CVSS", "assessment report" |
ReportTemplate |
Skill Integration
WebAssessment coordinates with specialized skills:
| Phase |
Skill |
Purpose |
| Scope Definition |
Recon |
Corporate structure, domain enumeration |
| Target Discovery |
Recon |
Subdomains, endpoints, ports |
| Understanding |
WebAssessment |
App narrative, user flows, sensitive data |
| Threat Modeling |
WebAssessment |
Attack scenarios, test prioritization |
| Injection Testing |
PromptInjection |
LLM-specific attacks |
| Intelligence |
OSINT |
People, companies, social media |
Assessment Workflow
1. Corporate Structure (Recon) → Define scope and targets
2. Subdomain Enumeration (Recon) → Find all domains
3. Endpoint Discovery (Recon) → Extract JS endpoints
4. Understand Application → Build app narrative
5. Create Threat Model → Prioritize attack scenarios
6. Execute Testing → Test against identified threats
7. Report Findings → Document with PoCs
Recon Skill Tools
WebAssessment uses tools from the Recon skill:
# Corporate structure for scope
bun ${SKILLS_HOME}/Security/Recon/Tools/CorporateStructure.ts target.com
# Subdomain enumeration
bun ${SKILLS_HOME}/Security/Recon/Tools/SubdomainEnum.ts target.com
# Endpoint discovery from JavaScript
bun ${SKILLS_HOME}/Security/Recon/Tools/EndpointDiscovery.ts https://target.com
# Port scanning
bun ${SKILLS_HOME}/Security/Recon/Tools/PortScan.ts target.com
# Path discovery
bun ${SKILLS_HOME}/Security/Recon/Tools/PathDiscovery.ts https://target.com
UnderstandApplication Output
Produces structured narrative including:
- Summary: Purpose, industry, user base, critical functions
- User Roles: Access levels and capabilities
- User Flows: Step-by-step processes with sensitive data
- Technology Stack: Frontend, backend, auth, third-party
- Attack Surface: Entry points, inputs, file uploads, websockets
CreateThreatModel Output
Generates prioritized attack plan:
- Threats: OWASP/CWE mapped with risk scores
- Attack Paths: Multi-step attack scenarios
- Test Plan: Prioritized with tool suggestions
- Effort Estimates: Quick/medium/extensive per threat
Threat Categories
| Category |
Triggers On |
| Authentication |
Auth mechanisms detected |
| Access Control |
Multiple user roles |
| Injection |
All web apps |
| Data Exposure |
Sensitive data identified |
| File Upload |
Upload functionality |
| API Security |
API endpoints |
| WebSocket |
WebSocket detected |
| Business Logic |
All web apps |
| Payment Security |
Payment flows |
6-Phase Pentest Methodology
Phase 0: Scoping & Preparation
Phase 1: Reconnaissance (Recon skill)
Phase 2: Mapping (content discovery)
Phase 3: Vulnerability Analysis
Phase 4: Exploitation
Phase 5: Reporting
Key Principles
- Authorization first - Never test without explicit permission
- Understand before testing - Build app narrative first
- Threat model guides testing - Don't test blindly
- Breadth then depth - Wide recon, focused exploitation
- Document everything - Notes, screenshots, commands
Workflow Index
Core Assessment:
Workflows/UnderstandApplication.md - Application reconnaissanceWorkflows/CreateThreatModel.md - Attack scenario generation
Penetration Testing:
Workflows/pentest/MasterMethodology.md - 6-phase methodologyWorkflows/pentest/ToolInventory.md - Security tools referenceWorkflows/pentest/Reconnaissance.md - Asset discoveryWorkflows/pentest/Exploitation.md - Vulnerability testing
Web Fuzzing:
Workflows/ffuf/FfufGuide.md - FFUF fuzzing guideWorkflows/ffuf/FfufHelper.md - Automated fuzzing helper
Bug Bounty:
Workflows/bug-bounty/Programs.md - Program trackingWorkflows/bug-bounty/AutomationTool.md - Bounty automation
Web App Testing:
Workflows/webapp/TestingGuide.md - Playwright testingWorkflows/webapp/Examples.md - Testing patterns
OSINT:
Workflows/osint/MasterGuide.md - OSINT methodologyWorkflows/osint/Reconnaissance.md - Domain reconWorkflows/osint/SocialMediaIntel.md - SOCMINTWorkflows/osint/Automation.md - SpiderFoot/MaltegoWorkflows/osint/MetadataAnalysis.md - ExifTool analysis
AI-Powered:
Workflows/VulnerabilityAnalysisGemini3.md - Gemini deep analysis
Examples
Example 1: Full assessment workflow
User: "Security assessment on app.example.com"
→ Run UnderstandApplication to build narrative
→ Run CreateThreatModel to prioritize testing
→ Follow MasterMethodology with threat model guidance
→ Report findings with OWASP/CWE references
Example 2: Quick threat model
User: "How would I attack this app?"
→ Run CreateThreatModel on target
→ Get prioritized attack paths
→ Get test plan with tool suggestions
Example 3: Integrate with Recon
User: "Assessment on target.com including all subdomains"
→ CorporateStructure (Recon) → Find parent/child companies
→ SubdomainEnum (Recon) → Find all subdomains
→ EndpointDiscovery (Recon) → Extract JS endpoints
→ UnderstandApplication → Build app narrative
→ CreateThreatModel → Generate attack plan
1---2name: webassessment3description: Full web app security assessment — app understanding, threat modeling, OWASP testing, ffuf fuzzing, Playwright automation, AI-assisted vuln analysis. Coordinates with Recon and PromptInjection skills. USE WHEN web assessment, pentest, security testing, vulnerability scan, threat model app, understand application, create threat model, STRIDE, DREAD, PASTA, vulnerability analysis, Gemini analysis, ffuf, fuzzing, bug bounty, OSINT, browser automation, Playwright.4---56## Customization78**Before executing, check for user customizations at:**9`${PAI_USER_DIR}/SKILLCUSTOMIZATIONS/WebAssessment/`1011If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.121314<!-- ## 🚨 MANDATORY: Voice Notification (REQUIRED BEFORE ANY ACTION)1516**You MUST send this notification BEFORE doing anything else when this skill is invoked.**17181. **Send voice notification**:19 ```bash20 curl -s -X POST http://localhost:8888/notify \21 -H "Content-Type: application/json" \22 -d '{"message": "Running the WORKFLOWNAME workflow in the WebAssessment skill to ACTION"}' \23 > /dev/null 2>&1 &24 ```25-->26272. **Output text notification**:28 ```29 Running the **WorkflowName** workflow in the **WebAssessment** skill to ACTION...30 ```3132**This is not optional. Execute this curl command immediately upon skill invocation.**3334# WebAssessment Skill3536Security assessment infrastructure integrating reconnaissance, threat modeling, and vulnerability testing.373839## Workflow Routing4041| Trigger | Workflow |42|---------|----------|43| "understand application", "what does this app do", "map the application" | UnderstandApplication |44| "threat model", "attack scenarios", "how would I attack", "STRIDE analysis", "DREAD scoring", "PASTA threat model" | CreateThreatModel |45| "pentest", "security assessment", "test for vulnerabilities" | Pentest/MasterMethodology |46| "fuzz with ffuf", "directory fuzzing", "content discovery" | ffuf/FfufGuide |47| "OSINT", "reconnaissance", "open source intelligence" | osint/MasterGuide |48| "test web app", "Playwright", "browser automation" | webapp/TestingGuide |49| "bug bounty", "bounty programs" | bug-bounty/Programs |50| "vulnerability analysis with AI", "Gemini analysis" | VulnerabilityAnalysisGemini3 |51| "security report", "finding template", "CVSS", "assessment report" | ReportTemplate |5253## Skill Integration5455WebAssessment coordinates with specialized skills:5657| Phase | Skill | Purpose |58|-------|-------|---------|59| Scope Definition | **Recon** | Corporate structure, domain enumeration |60| Target Discovery | **Recon** | Subdomains, endpoints, ports |61| Understanding | **WebAssessment** | App narrative, user flows, sensitive data |62| Threat Modeling | **WebAssessment** | Attack scenarios, test prioritization |63| Injection Testing | **PromptInjection** | LLM-specific attacks |64| Intelligence | **OSINT** | People, companies, social media |6566## Assessment Workflow6768```691. Corporate Structure (Recon) → Define scope and targets702. Subdomain Enumeration (Recon) → Find all domains713. Endpoint Discovery (Recon) → Extract JS endpoints724. Understand Application → Build app narrative735. Create Threat Model → Prioritize attack scenarios746. Execute Testing → Test against identified threats757. Report Findings → Document with PoCs76```7778## Recon Skill Tools7980WebAssessment uses tools from the Recon skill:8182```bash83# Corporate structure for scope84bun ${SKILLS_HOME}/Security/Recon/Tools/CorporateStructure.ts target.com8586# Subdomain enumeration87bun ${SKILLS_HOME}/Security/Recon/Tools/SubdomainEnum.ts target.com8889# Endpoint discovery from JavaScript90bun ${SKILLS_HOME}/Security/Recon/Tools/EndpointDiscovery.ts https://target.com9192# Port scanning93bun ${SKILLS_HOME}/Security/Recon/Tools/PortScan.ts target.com9495# Path discovery96bun ${SKILLS_HOME}/Security/Recon/Tools/PathDiscovery.ts https://target.com97```9899## UnderstandApplication Output100101Produces structured narrative including:102- **Summary**: Purpose, industry, user base, critical functions103- **User Roles**: Access levels and capabilities104- **User Flows**: Step-by-step processes with sensitive data105- **Technology Stack**: Frontend, backend, auth, third-party106- **Attack Surface**: Entry points, inputs, file uploads, websockets107108## CreateThreatModel Output109110Generates prioritized attack plan:111- **Threats**: OWASP/CWE mapped with risk scores112- **Attack Paths**: Multi-step attack scenarios113- **Test Plan**: Prioritized with tool suggestions114- **Effort Estimates**: Quick/medium/extensive per threat115116## Threat Categories117118| Category | Triggers On |119|----------|-------------|120| Authentication | Auth mechanisms detected |121| Access Control | Multiple user roles |122| Injection | All web apps |123| Data Exposure | Sensitive data identified |124| File Upload | Upload functionality |125| API Security | API endpoints |126| WebSocket | WebSocket detected |127| Business Logic | All web apps |128| Payment Security | Payment flows |129130## 6-Phase Pentest Methodology131132**Phase 0**: Scoping & Preparation133**Phase 1**: Reconnaissance (Recon skill)134**Phase 2**: Mapping (content discovery)135**Phase 3**: Vulnerability Analysis136**Phase 4**: Exploitation137**Phase 5**: Reporting138139## Key Principles1401411. **Authorization first** - Never test without explicit permission1422. **Understand before testing** - Build app narrative first1433. **Threat model guides testing** - Don't test blindly1444. **Breadth then depth** - Wide recon, focused exploitation1455. **Document everything** - Notes, screenshots, commands146147## Workflow Index148149**Core Assessment:**150- `Workflows/UnderstandApplication.md` - Application reconnaissance151- `Workflows/CreateThreatModel.md` - Attack scenario generation152153**Penetration Testing:**154- `Workflows/pentest/MasterMethodology.md` - 6-phase methodology155- `Workflows/pentest/ToolInventory.md` - Security tools reference156- `Workflows/pentest/Reconnaissance.md` - Asset discovery157- `Workflows/pentest/Exploitation.md` - Vulnerability testing158159**Web Fuzzing:**160- `Workflows/ffuf/FfufGuide.md` - FFUF fuzzing guide161- `Workflows/ffuf/FfufHelper.md` - Automated fuzzing helper162163**Bug Bounty:**164- `Workflows/bug-bounty/Programs.md` - Program tracking165- `Workflows/bug-bounty/AutomationTool.md` - Bounty automation166167**Web App Testing:**168- `Workflows/webapp/TestingGuide.md` - Playwright testing169- `Workflows/webapp/Examples.md` - Testing patterns170171**OSINT:**172- `Workflows/osint/MasterGuide.md` - OSINT methodology173- `Workflows/osint/Reconnaissance.md` - Domain recon174- `Workflows/osint/SocialMediaIntel.md` - SOCMINT175- `Workflows/osint/Automation.md` - SpiderFoot/Maltego176- `Workflows/osint/MetadataAnalysis.md` - ExifTool analysis177178**AI-Powered:**179- `Workflows/VulnerabilityAnalysisGemini3.md` - Gemini deep analysis180181## Examples182183**Example 1: Full assessment workflow**184```185User: "Security assessment on app.example.com"186→ Run UnderstandApplication to build narrative187→ Run CreateThreatModel to prioritize testing188→ Follow MasterMethodology with threat model guidance189→ Report findings with OWASP/CWE references190```191192**Example 2: Quick threat model**193```194User: "How would I attack this app?"195→ Run CreateThreatModel on target196→ Get prioritized attack paths197→ Get test plan with tool suggestions198```199200**Example 3: Integrate with Recon**201```202User: "Assessment on target.com including all subdomains"203→ CorporateStructure (Recon) → Find parent/child companies204→ SubdomainEnum (Recon) → Find all subdomains205→ EndpointDiscovery (Recon) → Extract JS endpoints206→ UnderstandApplication → Build app narrative207→ CreateThreatModel → Generate attack plan208```
mj-deving