Converted and distributed by TomeVault — claim your Tome and manage your conversions.
Testing Security
Basic security testing (OWASP, auth, data exposure) Use when this capability is needed.
tomevault-io
Updated Testing Security by tomevault-io · 4f44ef8
npx skillmds@latest add tomevault-io/testing-security File contents
---name: testing-securitydescription: Basic security testing (OWASP, auth, data exposure) Use when this capability is needed.---<input_requirements> <required>Authorization model and roles</required> <required>List of critical endpoints/functions</required> <required>Data classification and risk areas</required> <required>Allowed check set and environment</required> <optional>Access to logs/monitoring and request-id</optional></input_requirements><execution_rules> <rule importance="critical">Verify authn/authz for each role and forbidden path</rule> <rule importance="critical">Verify session management (expiration, logout, refresh)</rule> <rule importance="high">Verify input validation (XSS/SQLi) without destroying data</rule> <rule importance="high">Verify CSRF for state-changing operations (if applicable)</rule> <rule importance="high">Verify rate limiting and abuse blocking</rule> <rule importance="medium">Check data leaks in responses, logs, and errors</rule></execution_rules><coverage> <focus> <item>Broken access control</item> <item>Authentication failures</item> <item>Security misconfiguration</item> <item>Data exposure (PII/secrets)</item> <item>Validation and injection vulnerabilities</item> </focus></coverage><quality_rules> <rule importance="critical">All steps are reproducible and documented</rule> <rule importance="high">Role, token, and request context are stated</rule> <rule importance="high">Evidence exists (request/response, request-id)</rule> <rule importance="medium">Risk assessment is tied to data and roles</rule></quality_rules><do_not> <item importance="critical">Do not run security tests without permission</item> <item importance="critical">Do not test production without permission</item> <item importance="high">Do not perform destructive actions and mass deletions</item> <item importance="high">Do not extract or store real user data</item></do_not><example_checks> <check>Verify User role access to an Admin resource (must be forbidden)</check> <check>Verify session expiration and inaccessibility after logout</check> <check>Verify handling of dangerous characters in input fields</check></example_checks>---> Converted and distributed by [TomeVault](https://tomevault.io/claim/ozerohax) — claim your Tome and manage your conversions.<!-- tomevault:4.0:skill_md:2026-04-11 -->
tomevault-io/skills-registry/tree/main/ozerohax--assistagents--security commit 4f44ef8b6c
Frequently asked questions
Run npx skillmds@latest add tomevault-io/testing-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Basic security testing (OWASP, auth, data exposure) Use when this capability is needed. It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.