skills.rest
davdunc
davduncCOMMUNITY
Explore all skills by this author →
Website𝕏@davduncGitHub

WebAssessment

Orchestrate web application security assessments with threat models and prioritized testing plans.

1|Updated Apr 16, 2026
Search Tags:#owasp#threat modeling#web security#vulnerability analysis#bug bounty#playwright testing#ffuf fuzzing
One-click install
npx skills add https://github.com/davdunc/pai-framework --skill webassessment-davdunc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: WebAssessment
Source: https://github.com/davdunc/pai-framework/tree/main/skills/Security/WebAssessment
Command: npx skills add https://github.com/davdunc/pai-framework --skill webassessment-davdunc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve?

WebAssessment reduces the time and guesswork of doing a full, repeatable web app security assessment by coordinating understanding, threat modeling, and testing into a single workflow.

Core Features & Use Cases

  • Application understanding: Produces a structured narrative of what the app does, who uses it, its user flows, and its attack surface.
  • Threat modeling and prioritization: Generates prioritized OWASP/CWE-mapped attack scenarios and a test plan to drive efficient coverage.
  • Web testing orchestration: Guides recon, content discovery (including ffuf fuzzing), web app testing via browser automation (Playwright), and AI-assisted vulnerability analysis (Gemini).
  • Integration-ready outputs: Produces artifacts that align with specialized skills (Recon, PromptInjection, OSINT) for broader coverage and better sequencing.

Quick Start

Run WebAssessment against a target app to understand the application, generate a prioritized threat model, and execute the relevant pentest workflows with actionable findings.

Frequently Asked Questions about WebAssessment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an end-to-end web application security assessment?▼

Run an end-to-end web application security assessment by orchestrating application understanding, threat modeling, and prioritized testing plans into a single workflow using YAML-defined routing. This coordinates recon, browser automation, and fuzzing to produce actionable findings.

How does threat modeling integrate with web testing orchestration?▼

Threat modeling integrates with web testing orchestration by generating OWASP and CWE-mapped attack scenarios that prioritize a structured test plan. This sequence drives efficient coverage through guided ffuf fuzzing and Playwright browser automation.

Can I use Playwright testing and ffuf fuzzing for bug bounty preparation?▼

You can use Playwright testing and ffuf fuzzing for bug bounty preparation by executing the guided testing workflows. The workflow maps the application's attack surface and runs content discovery to identify exploitable vulnerabilities.

What is the best way to generate OWASP-style attack scenarios for web pentesting?▼

The best way to generate OWASP-style attack scenarios for web pentesting is to produce a structured narrative of the application's user flows and attack surface. This narrative directly informs and prioritizes the generated attack scenarios.

Do I need specific dependencies to perform vulnerability analysis with Gemini?▼

Specific external dependencies are not required to perform vulnerability analysis with Gemini, as the workflow operates independently. It orchestrates AI-assisted vulnerability analysis alongside local browser automation and fuzzing tools.

Why does web security assessment require mandatory local voice notification via curl?▼

Web security assessment requires mandatory local voice notification via curl to alert you during automated testing phases. This ensures you receive immediate updates on workflow routing and assessment progress without constant manual monitoring.

Related Skills

Explore More Legal & Compliance Skills→
valITinovalITino
7

recon-deep

Automate comprehensive reconnaissance to map a target's attack surface.

Community
Advanced
allsmogallsmog
22

Exploit Techniques

Generate Python exploit templates for SQL and command injection vulnerabilities.

Community
Advanced
MicrockMicrock
322

ffuf-web-fuzzing

Automate web content discovery by fuzzing targets with ffuf to reveal hidden resources.

Community
Advanced
AndyAnh174AndyAnh174

Security Scanning Tools

Guide security scanning tools for network, web, and cloud assessments.

Community
Advanced