Security Testing & Verification

Trust Score 77/100

Automated and manual security tests for web apps: CSRF, rate limiting, input validation, security headers and pre-deployment checklist.

triggers:security testingtest securitypre-deploymentverify securitytest CSRFtest rate limitsecurity checklist

GitHub SKILL.md

What it does

This skill provides a structured security-testing workflow for web applications, including automated scripts and manual checks that verify CSRF protection, rate limiting, input validation, security headers, authentication/authorization, and dependency vulnerabilities. It collates test commands, expected outputs, and a pre-deployment checklist to ensure security controls are working before release.

When to use it

Use this skill before deployments, during CI/CD security jobs, or when auditing an application for common web vulnerabilities. Triggers include pre-deployment testing, regression testing after security fixes, or a quick checklist run when onboarding a repo.

What's included

Scripts: references to rate-limit and security-test scripts (documented in the SKILL.md).
References: guidance on external scanners (securityheaders.com, Mozilla Observatory, SSL Labs) and OWASP testing practices.
Instructions: step-by-step commands for testing rate limits, CSRF behavior, input validation (XSS/email/length checks), security headers, authentication/authorization cases, dependency audits (npm audit) and CI integration.

Compatible agents

Best suited for agents and CI runners that can execute shell/node scripts and parse outputs: Claude Code, Copilot/Codex-style code runners, and CI automation agents. It assumes access to the repo and a testable deployment or local server.

Audit Summary

A documentation-only skill providing security testing checklists and example curl/bash commands for web apps (CSRF, rate limiting, input validation, security headers, auth). No bundled scripts — all instructions are manual test commands targeting localhost:3000. Well-structured content but project-specific (references Clerk, Stripe, Convex) rather than generic.

Watch Out

Project-specific — references Clerk, Stripe, Convex, and localhost:3000 endpoints
No actual runnable scripts bundled — purely instructional documentation
Includes XSS/SQLi payload examples which could trigger security scanners

Notes

Not malicious — the XSS and SQLi payloads are standard testing examples for security verification. The skill is essentially a well-written security testing guide/checklist rather than an executable skill. Would be more useful with actual bundled test scripts.

Information

Repository: secure-claude-skills
Stars: 7

Trust Score

Overall77

Security92

Code Quality68

Architecture52

Usefulness48

Related Skills

Development Worktree

Create an isolated git worktree for feature work, auto-run project setup, and verify a clean test baseline before development.

TradeOS

Natural-language driven CEX trading and portfolio management for agents: API key vaulting, multi-exchange orders, DCA, arbitrage scanning, alerts and security r

Full Stack Builder

End-to-end builder that scaffolds, implements, tests, and optionally deploys web and API applications from a natural-language specification.

Claw Bench

Benchmarking skill that guides an agent through a structured suite of capability tests and reporting steps for leaderboard submission.

Java 25 & Spring Boot 4 Code Reviewer

Run focused, evidence-based code reviews for Java 25 and Spring Boot 4 projects — migration risks, architecture boundaries, null-safety (JSpecify), security, an

ArcKit — French Public Procurement (fr-marche-public)

Generates French public procurement (Dossier de Consultation des Entreprises) drafts aligned with the Code de la Commande Publique, UGAP frameworks, and DINUM d

ArcKit Architecture Conformance

Run a systematic architecture conformance assessment that compares ADRs and principles against HLD/DLD artifacts to surface drift, violations, and technical deb

Vibe Security Auditor

Audits AI-generated codebases for critical security flaws like exposed keys, broken RLS, and insecure payment flows.

Back to Skills