Security Testing Agent Skill

Use this skill when you need to design security testing around OWASP risks, vulnerability scanning, and penetration scenarios; triggers include 安全测试 and security testing.

13k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

144

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/naodeng/awesome-qa-skills --skill security-testing

What comes with it

51 254 bytes besides the instruction

README.md

agents/openai.yaml

evals/cases/basic-success.yaml

evals/cases/edge-domain-boundary.yaml

evals/cases/edge-incomplete-input.yaml

evals/eval.yaml

examples/owasp-zap-scan/README.md

examples/owasp-zap-scan/run-scan.sh

output-formats.md

output-templates/template-csv.csv

output-templates/template-excel.tsv

output-templates/template-json.json

output-templates/template-markdown.md

output-templates/template-word.md

output-templates/template-xmind.md

prompts/security-testing.md

quick-start.md

references/troubleshooting.md

scripts/batch_convert_templates.py

scripts/convert_formats.py

scripts/convert_output_formats.py

scripts/convert_to_csv.py

scripts/convert_to_excel.py

scripts/convert_to_json.py

scripts/convert_to_markdown.py

scripts/convert_to_word.py

scripts/convert_to_xmind.py

scripts/parse_csv.py

scripts/parse_excel.py

scripts/parse_formats.py

scripts/parse_json.py

scripts/parse_markdown.py

scripts/parse_output_formats.py

scripts/parse_word.py

scripts/parse_xmind.py

The instruction itself

as written by the author

安全测试（中文版）

英文版： 见对应英文技能。

何时使用

需要在真实项目里处理 security testing 相关任务。
需要一份可以直接用于执行、评审或跟进的结果。

执行流程

阅读并遵循「按需加载」中的主提示词（覆盖清单、输出结构、质量要求）。
只补充真正影响结果的项目上下文：范围、环境、限制、风险、依赖、期望产出。
信息不全时先给可用初版，并显式标出假设与信息缺口。
默认 Markdown；用户指定其他格式时再切换。

核心约束

按风险/业务影响排优先级，不要平均摊铺。
把「已确认事实」和「当前假设」分开写。
不要编造用户未提供的接口、字段、环境或根因细节。
结果必须可执行：场景具体、有优先级、能指导下一步。

按需加载

产出前必须阅读并遵循 prompts/security-testing.md（最低覆盖清单、输出结构、质量要求）。
需要 Excel/CSV/JSON/Word 等格式时：读 output-formats.md，并按用户格式要求输出。
需要套用现成模板时：读 output-templates/ 中匹配的模板，不要自创冲突结构。
用户要示例或对标现有资产时：读 examples/ 中相关样例。
需要框架规范、排障、报告 schema 等深资料时：只读 references/ 里与当前问题相关的文件，不要整目录通读。
需要格式转换或辅助校验时：优先使用 scripts/ 中已有脚本，而不是重写一遍。
需要评测/回归本 skill 时：使用 evals/，并用 skill-up 校验与运行。
用户只要最短上手路径时：读 quick-start.md。

交付前自检

[ ] 已遵循主提示词的输出结构
[ ] 最低覆盖关注：范围和关键资产、高风险攻击面、鉴权和授权检查、输入输出处理风险、敏感数据保护、会话或令牌处理、配置和依赖风险、优先级和业务影响…（细节以主提示词为准）
[ ] 已覆盖最低清单，或标明为何省略
[ ] 高风险项有明确优先级
[ ] 未编造用户未提供的细节
[ ] 假设与信息缺口已标明

常见误区

范围和上下文都不清楚时，不要假装已经完整可用。
不要把所有项写成同等重要。
不要跳过假设与信息缺口。
不要输出大段与当前工具链无关的空泛理论。

Other skills for the same job

different authors, same section of the catalogue

Network 101

by ComeOnOliver

×2

This skill should be used when the user asks to "set up a web server", "configure HTTP or HTTPS", "perform SNMP enumeration", "configure SMB shares", "test network services", or needs guidance on configuring and testing network services for penetration testing labs.

This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Smtp Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.

7k tokens

SQL Injection Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.

6k tokens

SSH Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.

8k tokens

Wordpress Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.

7k tokens

How to use it

Copy the folder

Take naodeng/awesome-qa-security-testing from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.