yao-websecurity-skill

Automates web application security audits and generates comprehensive reports in multiple formats.

1.3k|143|Updated Apr 6, 2026

Search Tags:#vulnerability assessment #security testing #report generation #security audit #web security

Ready to run

npx skills add https://github.com/yaojingang/yao-open-skills --skill yao-websecurity-skill

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: yao-websecurity-skill
Source: https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-websecurity-skill
Command: npx skills add https://github.com/yaojingang/yao-open-skills --skill yao-websecurity-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, Jinja2, pandas, and includes scripts (resource) and references (resource) and templates (resource) and evals (resource) and reports (resource) components.

What problem does it solve?

This Skill automates the process of web security auditing and report generation, saving time and resources compared to manual review.

Core Features & Use Cases

Security Review Automation: Automates the security review process, including system understanding, attack surface filtering, and evidence-driven conclusions.
Vulnerability Checklist: Built-in vulnerability ontology covering a wide range of common security checks.
Review Modes: Offers various review modes like static, dynamic-safe, dynamic-active, online-authorized, and hybrid for different scenarios.
Reporting: Generates detailed security reports in Excel, HTML, Markdown, and PDF formats with Chinese support.

Quick Start

Run the yao-websecurity-skill to audit the security of your web application located at 'https://example.com'.

Frequently Asked Questions about yao-websecurity-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate web security auditing and generate a vulnerability report?▼

Automate web security auditing by running an automated review process that filters the attack surface and generates detailed vulnerability reports in formats like Excel, HTML, Markdown, and PDF.

What is the best way to conduct a security audit for a web application?▼

The best way to conduct a security audit is using a hybrid approach that combines static and dynamic review modes, leveraging a built-in vulnerability ontology to generate evidence-driven security conclusions.

Can I generate security audit reports in Excel and PDF formats with Chinese support?▼

Yes, you can generate detailed security audit reports in Excel, HTML, Markdown, and PDF formats, including full Chinese language support for vulnerability management and compliance documentation.

Does web vulnerability assessment work with dynamic-active and static review modes?▼

Yes, web vulnerability assessment supports multiple review modes including static, dynamic-safe, dynamic-active, online-authorized, and hybrid modes to suit different website security testing scenarios.

Do I need Python libraries like requests and pandas to run a security audit?▼

Yes, you need Python libraries like requests, Jinja2, and pandas to handle HTTP requests, render templates, and perform data analysis during the automated security audit process.

What limitations should I consider when using dynamic-active security testing?▼

When using dynamic-active security testing, ensure you have proper authorization for online-authorized modes to avoid unintended disruptions, as active scanning directly interacts with the target web application.