skills.rest
ShiplightAI
ShiplightAIOFFICIAL
Explore all skills by this author →
GitHub

security-review

Identify and validate web application security gaps through browser-based testing.

Updated Aug 23, 2026
Search Tags:#security#owasp#csp#web-security#headers#penetration-testing#browser-based
One-click install
npx skills add https://github.com/ShiplightAI/codex-plugin --skill security-review-shiplightai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/ShiplightAI/codex-plugin/tree/main/agents/skills/security-review
Command: npx skills add https://github.com/ShiplightAI/codex-plugin --skill security-review-shiplightai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Evaluate your application's security posture against industry standards and validate findings through browser-based penetration testing. This review covers the attack surface that static analysis tools miss — runtime behavior, header configuration, authentication flows, and client-side vulnerabilities.

Core Features & Use Cases

  • Phase Overview: Educate, Scope, Analyze, Report, Remediate, with browser-based validation and evidence collection.
  • Standards Referenced: OWASP Top 10, OWASP ASVS, NIST 800-63B, and related guidance; exposure of runtime security controls, headers, and CSRF protections.
  • Use Case: Pre-production security review to identify runtime vulnerabilities in authentication flows, header misconfigurations, and client-side exposures.

Quick Start

Launch a browser-based security review against your app and validate headers, tokens, and access controls with automated checks.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test web application security headers and CSP configuration in the browser?▼

Browser-based security testing validates web application security headers and CSP configurations by executing runtime checks against your live app to identify misconfigurations and enforce content security policies.

What is the best way to perform a pre-production penetration test for SPA authentication flows?▼

Pre-production penetration testing for SPA authentication flows uses browser-based checks to validate token handling, access controls, and runtime client-side vulnerabilities, collecting evidence aligned with OWASP and NIST standards.

Does browser-based security testing cover the same vulnerabilities as static analysis?▼

Browser-based security testing covers runtime client-side vulnerabilities, header configurations, and authentication flows that static analysis tools miss, validating actual application behavior during security reviews.

Can I automate regression testing for CORS and CSRF protections using YAML?▼

You can automate regression testing for CORS and CSRF protections by defining YAML-based tests that execute browser-based validation checks, recording evidence and exporting findings for continuous security audits.

How do I validate web application security posture against OWASP ASVS standards?▼

Validating web application security posture against OWASP ASVS standards involves phase-based workflows that educate, scope, analyze, report, and remediate runtime vulnerabilities through browser-based evidence collection.

What limitations exist when running browser-based security checks on server-rendered applications?▼

Browser-based security checks on server-rendered applications focus on client-side exposures, header configurations, and authentication flows, but may not fully assess server-side logic vulnerabilities outside the browser's runtime environment.

Related Skills

Explore More Software Engineering Skills→
syntropic137syntropic137

playwright-debug

Capture runtime errors, network failures, and DOM state from web UIs with Playwright.

Official
Intermediate
nksethnkseth

security-reviewer

Identify security vulnerabilities in code and infrastructure and deliver prioritized audit reports with remediation guidance.

Community
Advanced
cmaennercmaenner
5

code-review-security

Scan codebases for security vulnerabilities and dependency risks.

Community
Intermediate
sixscripts-aisixscripts-ai

SQL Injection Testing

Identify and demonstrate SQL injection vulnerabilities across MySQL, MSSQL, PostgreSQL, and Oracle.

Community
Advanced