What problem does it solve?
This Skill centralizes and standardizes security testing for web applications to identify and validate common vulnerabilities such as XSS, CSRF, SQL injection, authentication/authorization flaws, insecure headers, and improper session management before production rollout.
Core Features & Use Cases
- Security header validation: Checks CSP, X-Frame-Options, X-Content-Type-Options, HSTS and other important headers.
- Browser and API tests: Playwright-style browser tests for XSS and CSRF, API-level checks for authorization and SQL injection, and file upload security scenarios.
- Authentication & authorization checks: Password policy enforcement, account lockout behavior, session timeout simulation, and RBAC verification.
- Use Case: Run this Skill against a staging instance of a legal case management platform to validate input sanitization, secure cookie attributes, CSRF token handling, and that sensitive user data is not exposed via APIs.
Quick Start
Run the security-testing-specialist checklist against your staging site to execute automated header, XSS, CSRF, SQL injection, authentication, authorization, file upload, rate limiting, and HTTPS enforcement checks.
