skills.rest
ahuaracab
ahuaracabCOMMUNITY
Explore all skills by this author →
GitHub

security-testing

Plan and execute security tests across OWASP web, API, mobile, and LLM domains.

Updated Aug 31, 2026
Search Tags:#owasp#vulnerability assessment#security testing#threat modeling#penetration testing#api security#compliance audit
One-click install
npx skills add https://github.com/ahuaracab/test-genesis --skill security-testing-ahuaracab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-testing
Source: https://github.com/ahuaracab/test-genesis/tree/main/.agents/skills/security-testing
Command: npx skills add https://github.com/ahuaracab/test-genesis --skill security-testing-ahuaracab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security testing is often fragmented across tools and standards, making it hard to systematically cover OWASP vulnerability classes, map findings to compliance frameworks, and trace tests back to identified threats. This Skill provides a unified four-phase workflow (threat model, security plan, test execution, security report) covering all four OWASP domains. ## Core Features & Use Cases - Full OWASP Coverage: Test patterns for 40 vulnerability classes across Web Top 10 (A01-A10), API Top 10 (API01-API10), Mobile Top 10 (M1-M10), and LLM Top 10 (LLM01-LLM10). - Threat-Driven Planning: Build a threat register with STRIDE or risk-based modeling, then map every test case to a threat ID and OWASP class for full traceability. - Compliance Mapping: Link test results to ISO 27001, PCI-DSS, HIPAA, and SOC2 requirements, producing audit-ready security and compliance reports. - Use Case: Audit a REST API against the OWASP API Top 10 by generating @atc-decorated tests for BOLA, broken authentication, rate limiting, and SSRF, then produce a remediation backlog ranked by severity. ## Quick Start Ask the AI to run a security assessment of your web application against the OWASP Top 10, starting with a threat model and ending with a compliance-mapped findings report.

Frequently Asked Questions about security-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test my API against the OWASP API Top 10?▼

Start with a threat model identifying assets and risks, then generate @atc-decorated test cases for each API01-API10 class such as BOLA, broken authentication, and rate limiting. Example test suites are provided in the examples directory for direct adaptation.

What OWASP domains does this security testing workflow cover?▼

It covers all four OWASP domains: Web Top 10 (A01-A10), API Top 10 (API01-API10), Mobile Top 10 (M1-M10), and LLM Top 10 (LLM01-LLM10). LLM evaluation is delegated to the genai-testing skill for specialized metrics.

Can I map security tests to PCI-DSS or ISO 27001 compliance?▼

Yes, each test case maps to OWASP classes and can be linked to ISO 27001, PCI-DSS, HIPAA, or SOC2 clauses. Phase 3 generates a compliance audit report connecting test results to specific framework requirements.

Does this work with Playwright, Appium, or other test frameworks?▼

Yes, the workflow is framework-agnostic using an adapter pattern. Web tests can use Playwright or Selenium, mobile tests use Appium, and API tests work with curl, Postman, or any HTTP client.

How are LLM vulnerabilities like prompt injection tested?▼

LLM security testing uses the genai-testing skill with @evalCase decorators and metrics like PROMPT_INJECTION and SENSITIVE_INFO_DISCLOSURE. This skill provides the threat modeling context and unified reporting across all domains.

When should I use manual penetration testing instead of automated security tests?▼

The workflow defines three layers: automated code scans and dynamic test harnesses run in CI, while manual penetration testing is reserved for audit gates. Use Layer 3 manual testing for complex business logic flaws that automation cannot reach.

Related Skills

Explore More Software Engineering Skills→
utkusenutkusen
1.3k

sast-analysis

Map codebase architecture and technology stack into sast/architecture.md.

Community
Intermediate
TECH-HYTECH-HY

tpo-bug-tracking-template

Structures bug reports with severity classification, reproduction steps, and fix acceptance criteria.

Official
Basic
686f6c61686f6c61
105

regression-check

Analyzes Git diffs and executes relevant unit, integration and E2E tests to detect regressions.

Community
Intermediate
RohithdgrrRohithdgrr

ai-security

Scan prompts for injection signatures and score AI model security risks against MITRE ATLAS.

Community
Intermediate