Security Review
This is a proper penetration testing workflow that actually opens a browser and validates security issues at runtime, not just static analysis. It walks through OWASP Top 10 checks with real evidence: submitting XSS payloads to see if they render, testing JWT tampering, verifying HttpOnly flags on cookies, attempting CSRF attacks. The phased approach (educate, scope, analyze, report, remediate) means you get findings with CVE references and confidence scores, plus YAML regression tests to prevent backsliding. Use it before launches, after auth changes, or when handling payment data. It catches the stuff that only shows up in a live browser: misconfigured headers, insecure token storage, broken access controls.
- skills.sh installs
- 409
- GitHub stars
- 2
- last updated
- Jun 3, 2026
Install
$ npx -y skills add shiplightai/agent-skills --skill security-review --agent claude-codeInstalls into .claude/skills of the current project.
Files
This is a proper penetration testing workflow that actually opens a browser and validates security issues at runtime, not just static analysis. It walks through OWASP Top 10 checks with real evidence: submitting XSS payloads to see if they render, testing JWT tampering, verifying HttpOnly flags on cookies, attempting CSRF attacks. The phased approach (educate, scope, analyze, report, remediate) means you get findings with CVE references and confidence scores, plus YAML regression tests to prevent backsliding. Use it before launches, after auth changes, or when handling payment data. It catches the stuff that only shows up in a live browser: misconfigured headers, insecure token storage, broken access controls.
Browse the repository on GitHubSponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/shiplightai/agent-skills
- Categories
- Security, Git & Pull Requests, Code Review & Quality, AI & Agent Building
- First seen
- Jun 3, 2026
More from shiplightai/agent-skills
All 12Recommended
More Security
security-scanning-security-sastsickn33/antigravity-awesome-skillssecurity scanning security sast360skills.sh installs
web-securityacademind/ai-configEnforce web security and avoid security vulnerabilities297skills.sh installs
security-pr-checklist-skillpatricio0312rev/skillsCreates repeatable security review checklist for PRs with required checks, common pitfalls, and automated gating. Use for "security review", "PR checklist", "co271skills.sh installs
owasp-ai-testingmastepanoski/claude-skillsAI trustworthiness testing using OWASP AI Testing Guide v1. Execute 32 test cases across 4 layers (Application, Model, Infrastructure, Data) with practical payl245skills.sh installs