What problem does it solve? Security testers need a structured, repeatable process for assessing web applications, but reconnaissance, threat modeling, fuzzing, and vulnerability analysis are typically scattered across disconnected tools and notes. This Skill orchestrates the full assessment lifecycle from application understanding through prioritized remediation planning. ## Core Features & Use Cases - Application Understanding & Threat Modeling: Generates structured app narratives (user roles, flows, attack surface) and prioritized threat models mapped to OWASP and CWE with risk scores. - Testing Workflows: Provides a 6-phase pentest methodology, ffuf fuzzing guides with authenticated request templates, Playwright browser testing, and OSINT workflows (Sherlock, Osintgram, Shodan, Dehashed). - AI-Assisted Vulnerability Analysis: Correlates findings from ffuf, nuclei, nikto, nmap, and Burp using Gemini 3 Pro to detect vulnerability chains, calculate CVSS-based risk scores, and generate proof-of-concepts and remediation roadmaps. - Use Case: Given a target like app.example.com, run the UnderstandApplication workflow to build a narrative, generate a threat model to prioritize attack scenarios, execute the pentest methodology, then feed scan outputs into the Gemini analysis workflow for a prioritized report. ## Quick Start Ask the assistant to run a security assessment on an authorized target domain, and it will route through reconnaissance, application understanding, threat modeling, and vulnerability testing workflows automatically.
