security-testing-specialist

What problem does it solve?

This Skill centralizes and standardizes security testing for web applications to identify and validate common vulnerabilities such as XSS, CSRF, SQL injection, authentication/authorization flaws, insecure headers, and improper session management before production rollout.

Core Features & Use Cases

• Security header validation: Checks CSP, X-Frame-Options, X-Content-Type-Options, HSTS and other important headers.
• Browser and API tests: Playwright-style browser tests for XSS and CSRF, API-level checks for authorization and SQL injection, and file upload security scenarios.
• Authentication & authorization checks: Password policy enforcement, account lockout behavior, session timeout simulation, and RBAC verification.
• Use Case: Run this Skill against a staging instance of a legal case management platform to validate input sanitization, secure cookie attributes, CSRF token handling, and that sensitive user data is not exposed via APIs.

Quick Start

Run the security-testing-specialist checklist against your staging site to execute automated header, XSS, CSRF, SQL injection, authentication, authorization, file upload, rate limiting, and HTTPS enforcement checks.