web-vulnerability-discovery

To discover web vulnerabilities in authorized staging environments, this Skill performs browser-aware mapping and low-impact probing to validate weaknesses. It examines login pages, APIs, and redirects, comparing baseline and probe responses to confirm security issues.

Evidence-based validation for web security testing confirms issues by comparing baseline and probe responses. This Skill validates access control failures, injection signs, XSS, open redirects, weak sessions, and CORS misconfigurations using captured browser-visible behavior and response data.

Yes, you can safely enumerate APIs and test for CORS misconfigurations using low-impact probing. This Skill applies authorized testing to browser-accessible targets, mapping APIs and validating configuration weaknesses without relying on destructive testing or guesswork.

To generate a vulnerability report with labeled risk ratings in Chinese, this Skill collects evidence from low-impact probes and maps browser-visible behavior. It produces an evidence-based Chinese report containing reproducible findings and clear remediation steps.

Yes, this approach works for benchmark cases and local labs. The Skill is explicitly designed for owned websites, staging environments, and benchmark targets where safe discovery, validation, and reproducible vulnerability findings are required.

The limitation of low-impact probing for vulnerability discovery is that it applies only to explicitly permitted scopes, avoiding destructive testing. It focuses on browser-accessible targets and safe validation, meaning it is not suitable for aggressive penetration testing or unauthorized scopes.