skills.rest
machenjie
machenjieCOMMUNITY
Explore all skills by this author →
GitHub

web-security

Review web-facing changes for XSS, CSRF, SSRF, SQL injection, and access control.

4|Updated May 16, 2026
Search Tags:#web-security#owasp top 10#secure-by-design#ssrf defense#broken access control#xss protection#threat review
One-click install
npx skills add https://github.com/machenjie/rd-skills --skill web-security-machenjie
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-security
Source: https://github.com/machenjie/rd-skills/tree/main/src/foundation/capabilities/web-security
Command: npx skills add https://github.com/machenjie/rd-skills --skill web-security-machenjie

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents web-facing changes from introducing exploitable vulnerabilities by enforcing a systematic review of common attack classes before they ship.

Core Features & Use Cases

  • Exploit-class coverage: Reviews changes for XSS, CSRF, SSRF, SQL injection, RCE/command injection, path traversal, open redirects, insecure deserialization, upload abuse, and broken access control (IDOR and broken function-level authorization).
  • Non-negotiable security rules: Enforces context-aware output encoding, server-side authorization checks, parameterized database queries, and safe handling of uploads and server-side URL fetches.
  • Test evidence requirements: Defines what evidence must exist for each exploit class (or an explicit release escalation path when mitigation cannot be completed).

Quick Start

Use the web-security skill to review the security controls and required test evidence for a change that adds or modifies routes, APIs, rendering of user content, redirects, uploads, outbound fetches, or authorization logic.

Frequently Asked Questions about web-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is secure-by-design web development for preventing OWASP Top 10 exploit classes?▼

Secure-by-design web development prevents risks like XSS, CSRF, SSRF, SQL injection, and broken access control by enforcing documented server-side controls, context-aware encoding, and parameterized queries before shipping changes.

How do I review web API changes for SSRF defense and broken access control?▼

Review web API changes for SSRF defense by enforcing allowlisting and private-IP blocking, and verify broken access control by checking server-side authorization predicates and function-level authorization for each route.

Does this approach require test evidence for XSS protection and SQL injection mitigation?▼

Yes, mitigating XSS protection and SQL injection risks requires verifiable test evidence for each exploit class, or an explicit release escalation path when mitigation cannot be completed before shipping.

What's the best way to handle file upload abuse and insecure deserialization during threat review?▼

Handle file upload abuse by implementing isolated upload storage with content-based validation, and prevent insecure deserialization by applying documented server-side controls during your threat review.

When do I need a systematic threat review for open redirects and path traversal vulnerabilities?▼

You need a threat review for open redirects and path traversal whenever a change touches redirect behavior, route handling, or rendering of user-controlled data, ensuring context-aware encoding and server-side controls are documented.

Related Skills

Explore More Legal & Compliance Skills→
open-gsdopen-gsd
1.0k

security-review

Perform STRIDE-based threat modeling on codebases and output prioritized security findings.

Official
Advanced
KyaniteLabsKyaniteLabs
3

tastecheck-pass

Aggregate specialist self-checks and browser evidence into a SHIP or HOLD release decision.

Official
Advanced
phatblatphatblat
12

WebAssessment

Automate web application security assessments with reconnaissance, threat modeling, and vulnerability analysis.

Community
Advanced
BagelHoleBagelHole
46

dast-scanning

Perform DAST scans on web applications and APIs with OWASP ZAP.

Community
Intermediate