Automate Web App Security Audits

The bundle orchestrates a comprehensive security audit of web applications, APIs, and infrastructure across seven phases, invoking a named skill at each step. Phase 1 (Reconnaissance) uses scanning-tools, shodan-reconnaissance, and top-web-vulnerabilities to identify scope, gather intelligence, map the attack surface, and identify technologies. Phase 2 (Vulnerability Scanning) uses vulnerability-scanner, security-scanning-security-sast, and security-scanning-security-dependencies to run automated scanners, static analysis, and dependency audits. Phase 3 (Web Application Testing) uses top-web-vulnerabilities, sql-injection-testing, xss-html-injection, broken-authentication, idor-testing, file-path-traversal, and burp-suite-testing to test injection flaws, authentication, session management, access controls, and input validation. Phase 4 (API Security Testing) uses api-fuzzing-bug-bounty and api-security-best-practices to enumerate endpoints and test authentication, rate limiting, and error handling. Phase 5 (Penetration Testing) uses pentest-commands, pentest-checklist, ethical-hacking-methodology, and metasploit-framework to plan and execute attack scenarios and document proof of concept. Phase 6 (Security Hardening) uses security-scanning-security-hardening, auth-implementation-patterns, and api-security-best-practices to implement controls, security headers, authentication, authorization, and logging. Phase 7 (Reporting) uses reporting-standards to document findings, assess risk, and produce an executive summary and technical report.

Each phase includes copy-paste prompts invoking the relevant skill by name (for example, Use @sql-injection-testing to test for SQL injection vulnerabilities), plus a checklist covering the OWASP Top 10 (injection, broken authentication, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, vulnerable components, insufficient logging) and API-specific checks (authentication, authorization, rate limiting, input validation, error handling, security headers). Quality gates require all planned tests executed, vulnerabilities documented, proof of concepts captured, risk assessments completed, remediation steps provided, and a report generated.

Use it for security audits on web applications, API security testing, penetration testing, vulnerability scanning, application-security hardening, or compliance security assessments. It is not a substitute for environment-specific validation, testing, or expert review, and it stops for clarification when required inputs, permissions, safety boundaries, or success criteria are missing.

Input is the target application, API, or infrastructure scope. Output is a phase-by-phase audit trail: reconnaissance findings, scan and static-analysis results, web/API vulnerability findings with proof of concept, hardening changes applied, and a final risk-assessed report with remediation steps and an executive summary.

It names four related workflow bundles for adjacent concerns: development for secure development practices, wordpress for WordPress-specific security, cloud-devops for cloud security, and testing-qa for security testing.

Security teams and engineers running a full-scope audit (reconnaissance through hardening and reporting) who want the seven phases and their skill dependencies coordinated as one workflow instead of assembled ad hoc.