security-testing

Designs security testing programs covering SAST, DAST, dependency scanning, and penetration testing.

1|Updated Mar 21, 2026

Search Tags:#owasp #security testing #penetration testing #sast #vulnerability scanning #dast #ci pipeline

One-click install

npx skills add https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts --skill security-testing-kalilurrahman

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: security-testing
Source: https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts/tree/main/07-testing-quality/security-testing
Command: npx skills add https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts --skill security-testing-kalilurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams often treat security testing as a one-time pre-launch event, leaving vulnerabilities undetected until attackers find them. This Skill structures a continuous, layered security testing program integrated into CI/CD pipelines. ## Core Features & Use Cases - Layered Testing Matrix: Combines secrets scanning (Gitleaks, Trufflehog), SAST (Semgrep, Bandit), dependency scanning (Trivy, Safety), and DAST (OWASP ZAP) with clear CI-blocking rules. - Ready-to-Use CI Pipeline: Provides a complete GitHub Actions security workflow plus custom Semgrep rules for hardcoded secrets, SQL injection, and insecure patterns. - OWASP Top 10 Pentest Checklist: A manual penetration testing checklist covering access control, injection, SSRF, and cryptographic failures, paired with SLA-based remediation tracking. - Use Case: A team preparing a web API for launch uses this Skill to wire security scans into every pull request, run ZAP against staging, and enforce 24-hour SLAs on critical CVE fixes. ## Quick Start Ask the AI to design a security testing pipeline for your application, including SAST, dependency scanning, and an OWASP Top 10 penetration test checklist.

Frequently Asked Questions about security-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What should I do when a secret is committed to a repository?▼

Rotate the secret immediately and assume it is compromised the moment it is committed. Use Gitleaks or Trufflehog to scan full git history, then remove the secret from history and audit access logs for misuse.