security-tester

Identify security vulnerabilities in codebases by parsing routes, middleware, and schemas.

Updated Mar 12, 2026
One-click install
npx skills add https://github.com/Hashzin-0/Curion --skill security-tester
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-tester
Source: https://github.com/Hashzin-0/Curion/tree/main/.opencode/skills/security-tester
Command: npx skills add https://github.com/Hashzin-0/Curion --skill security-tester

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security testing is often manual and time-consuming; this skill automates a battery of tests against your own implementation to identify vulnerabilities before attackers.

Core Features & Use Cases

  • Reads your codebase surfaces (routes, middleware, schemas) to generate targeted test cases.
  • Simulates attacker behavior against each surface and reports findings with severity levels and remediation guidance.
  • Produces a structured findings report and helps guide a remediation loop to fix critical issues before deployment.

Quick Start

Run the security-tester against your project to generate the first findings report.

Frequently Asked Questions about security-tester

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate security testing for API endpoints in my own codebase?

Automate security testing by parsing codebase routes, middleware, and schemas to generate targeted injection, auth, and data-exfiltration probes. A running test harness executes these probes across local, staging, and production environments to identify vulnerabilities.

What is automated vulnerability scanning for source code?

Automated vulnerability scanning reads codebase surfaces like src/app/api or pages/api to simulate attacker behavior. It tests API endpoints, authentication, and data handling to produce a structured findings report with severity levels and remediation guidance.

Can I run penetration testing against my own codebase across staging and production environments?

Yes, you can run penetration testing across local, staging, and production environments. The testing requires a running test harness to execute probes against your API endpoints, file uploads, and database access to identify vulnerabilities.

Does automated security testing work with file uploads and database access handling?

Automated security testing applies to codebases handling file uploads and database access. It reads your service schemas and middleware to generate targeted probes that test these specific data handling surfaces for vulnerabilities.

How do I generate a findings report with severity levels for codebase vulnerabilities?

Generate a findings report by executing targeted probes against your codebase surfaces. The structured report includes severity levels for identified vulnerabilities and provides remediation guidance to help fix critical issues before deployment.

Do I need a running test harness to perform risk-assessment on my API routes?

Yes, a running test harness is required to perform risk-assessment on your API routes. The harness executes the generated injection, auth, and data-exfiltration probes against your codebase to identify and report security vulnerabilities.