skills.rest
jonnymuir
jonnymuirCOMMUNITY
Explore all skills by this author →
Website𝕏@jonnymooGitHub

security-regression-contract-audit

Audit C# security regression suites to separate genuine vulnerabilities from placeholder tests.

1|Updated Dec 23, 2025
Search Tags:#testing#csharp#security#refactoring#audit#regression
One-click install
npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill security-regression-contract-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-regression-contract-audit
Source: https://github.com/jonnymuir/Umbraco.Prism/tree/main/.claude/skills/security-regression-contract-audit
Command: npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill security-regression-contract-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill resolves the noise in security regression suites where failing tests often mix genuine product vulnerabilities with stale, non-functional placeholder tests.

Core Features & Use Cases

  • Boundary Tracing: Maps user-controlled inputs from entry points to sensitive sinks like redirect URIs.
  • Contract Separation: Distinguishes between meaningful behavioral assertions and implementation-coupled checks.
  • Use Case: When a security test suite fails, use this skill to identify which failures represent actual open-redirect or injection risks versus those that are merely testing debug-mode helpers or hardcoded false values.

Quick Start

Analyze the current security regression test suite to identify and replace placeholder assertions with behavioral requirements.

Frequently Asked Questions about security-regression-contract-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit security regression tests to isolate real vulnerabilities?▼

Audit security regression tests by separating genuine product vulnerabilities from stale placeholder tests. This isolates actual open-redirect or injection risks from tests merely checking debug-mode helpers or hardcoded false values.

Why do my C# security test suites fail with mixed vulnerability and placeholder results?▼

Security test suites fail with mixed results when behavioral assertions are coupled with implementation details. Contract separation distinguishes meaningful runtime verification of authentication properties from non-functional placeholder tests.

What is the best way to trace user-controlled inputs to redirect URIs during a security audit?▼

The best way to trace user-controlled inputs to redirect URIs is boundary tracing. This maps inputs from entry points directly to sensitive sinks, ensuring test coverage focuses on executable behavioral contracts for redirect safety.

Can I use this security audit approach for C# web applications requiring runtime verification of authentication properties?▼

Yes, this approach applies specifically to C# web applications where redirect safety and authentication properties require robust runtime verification. It ensures test coverage focuses on executable behavioral contracts rather than internal implementation details.

How do I replace stale placeholder assertions with executable behavioral requirements in a security test suite?▼

Replace stale placeholder assertions by analyzing the current security regression test suite. Contract separation identifies non-functional placeholder tests and substitutes them with executable behavioral requirements for genuine vulnerabilities.

When should I not use implementation-coupled checks for testing redirect safety in C#?▼

You should not use implementation-coupled checks when testing redirect safety because they test debug-only logic or hardcoded false values. Focus test coverage on executable behavioral contracts to verify actual open-redirect risks.

Related Skills

Explore More Software Engineering Skills→
zcacereszcaceres
7

test

Identify untested branches, error paths, and boundary conditions in test suites.

Community
Intermediate
tom-xstom-xs

test-driven-development

Enforce a Red-Green-Refactor cycle with failing tests before implementation.

Community
Advanced
0xShe0xShe
386

php-open-redirect-audit

Audit PHP code for open redirect vulnerabilities from user-controlled destinations.

Community
Advanced
BagelHoleBagelHole
46

dast-scanning

Perform DAST scans on web applications and APIs with OWASP ZAP.

Community
Intermediate