Security & Testing Agent Skills for Claude Code

Find and prove path traversal / local file inclusion in a web application during an authorized assessment.

Detect path traversal and local file inclusion attempts and success against a web application from request logs and file-access telemetry.

Comprehensive web quality audit covering performance, accessibility, SEO, and best practices.

Find and prove reflected cross-site scripting in a web application during an authorized assessment.

Harden a web application by suppressing stack-leaking response headers and deploying the security header set (CSP, HSTS…

When to activate: CSP, CORS, XSS prevention, CSRF, SRI, iframe sandbox, Trusted Types, web security headers

Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access…

Confirm, characterize, and demonstrate the impact of SQL injection in a web application during an authorized assessment.

Detect SQL injection attempts and successful exploitation against a web application from logs, WAF events, and database telemetry.

Confirm and characterize XML external entity (XXE) injection in a web application during an authorized assessment.

Detect cross-site scripting attempts and successful injection against a web application using request telemetry, Content-Security-Policy…

Harden a web application against XML external entity (XXE) injection by disabling DTD and external-entity processing in every XML parser…

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626…

Use when building or reviewing web apps, Mozilla WebAppSec auth/sessions, whitelist input, output encoding, CSRF/TLS/CSP, safe uploads…

Review local git changes or an architecture document against the Security, Privacy, and Compliance pillar of Google's Cloud…

E2E testing for Windows native desktop apps (WPF, WinForms, Win32/MFC, Qt) using pywinauto and Windows UI Automation.

Build, run and verify real Windows software from a Mac — including WPF and WinForms UI — using WinQuick's disposable Windows environments.

Execute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security…

Assess WordPress installations for common vulnerabilities and WordPress 7.0 attack surfaces.

Use when writing, running, or debugging tests in the Gutenberg repository — JavaScript unit tests (Jest), PHP tests (PHPUnit), or…

Evaluate whether a business, operations, finance, logistics, construction, or Web3 application honestly represents its product maturity.