security-review

Identify and validate web application security gaps through browser-based testing.

Updated Aug 23, 2026

Search Tags:#security #owasp #csp #web-security #headers #penetration-testing #browser-based

Ready to run

npx skills add https://github.com/ShiplightAI/codex-plugin --skill security-review-shiplightai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/ShiplightAI/codex-plugin/tree/main/agents/skills/security-review
Command: npx skills add https://github.com/ShiplightAI/codex-plugin --skill security-review-shiplightai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Evaluate your application's security posture against industry standards and validate findings through browser-based penetration testing. This review covers the attack surface that static analysis tools miss — runtime behavior, header configuration, authentication flows, and client-side vulnerabilities.

Core Features & Use Cases

Phase Overview: Educate, Scope, Analyze, Report, Remediate, with browser-based validation and evidence collection.
Standards Referenced: OWASP Top 10, OWASP ASVS, NIST 800-63B, and related guidance; exposure of runtime security controls, headers, and CSRF protections.
Use Case: Pre-production security review to identify runtime vulnerabilities in authentication flows, header misconfigurations, and client-side exposures.

Quick Start

Launch a browser-based security review against your app and validate headers, tokens, and access controls with automated checks.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test web application security headers and CSP configuration in the browser?▼

Browser-based security testing validates web application security headers and CSP configurations by executing runtime checks against your live app to identify misconfigurations and enforce content security policies.

What is the best way to perform a pre-production penetration test for SPA authentication flows?▼

Pre-production penetration testing for SPA authentication flows uses browser-based checks to validate token handling, access controls, and runtime client-side vulnerabilities, collecting evidence aligned with OWASP and NIST standards.

Does browser-based security testing cover the same vulnerabilities as static analysis?▼

Browser-based security testing covers runtime client-side vulnerabilities, header configurations, and authentication flows that static analysis tools miss, validating actual application behavior during security reviews.

Can I automate regression testing for CORS and CSRF protections using YAML?▼

You can automate regression testing for CORS and CSRF protections by defining YAML-based tests that execute browser-based validation checks, recording evidence and exporting findings for continuous security audits.

How do I validate web application security posture against OWASP ASVS standards?▼

Validating web application security posture against OWASP ASVS standards involves phase-based workflows that educate, scope, analyze, report, and remediate runtime vulnerabilities through browser-based evidence collection.

What limitations exist when running browser-based security checks on server-rendered applications?▼

Browser-based security checks on server-rendered applications focus on client-side exposures, header configurations, and authentication flows, but may not fully assess server-side logic vulnerabilities outside the browser's runtime environment.