[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M717FDZSTRFWTG4CNB4Q1697":3,"skill-same:01M717FDZSTRFWTG4CNB4Q1697":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":14,"repositoryHtmlUrl":58,"repositoryHomepageUrl":6,"ownerHtmlUrl":59,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":60,"install":61,"resources":74},"01M717FDZSTRFWTG4CNB4Q1697","web-security-testing",null,"Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fweb-security-testing\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"Security Testing","web","web security testing","security","testing","web application security","safe","testing workflow","2026","owasp top 10","control","top","xss","workflow","access","issues","Web Application Security Testing","authentication","for","Access Control","2026-11-10 10:12:30",false,"---\nname: web-security-testing\ndescription: \"Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.\"\ncategory: granular-workflow-bundle\nrisk: safe\nsource: personal\ndate_added: \"2026-02-27\"\n---\n\n# Web Security Testing Workflow\n\n## Overview\n\nSpecialized workflow for testing web applications against OWASP Top 10 vulnerabilities including injection attacks, XSS, broken authentication, and access control issues.\n\n## When to Use This Workflow\n\nUse this workflow when:\n- Testing web application security\n- Performing OWASP Top 10 assessment\n- Conducting penetration tests\n- Validating security controls\n- Bug bounty hunting\n\n## Workflow Phases\n\n### Phase 1: Reconnaissance\n\n#### Skills to Invoke\n- `scanning-tools` - Security scanning\n- `top-web-vulnerabilities` - OWASP knowledge\n\n#### Actions\n1. Map application surface\n2. Identify technologies\n3. Discover endpoints\n4. Find subdomains\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @scanning-tools to perform web application reconnaissance\n```\n\n### Phase 2: Injection Testing\n\n#### Skills to Invoke\n- `sql-injection-testing` - SQL injection\n- `sqlmap-database-pentesting` - SQLMap\n\n#### Actions\n1. Test SQL injection\n2. Test NoSQL injection\n3. Test command injection\n4. Test LDAP injection\n5. Document vulnerabilities\n\n#### Copy-Paste Prompts\n```\nUse @sql-injection-testing to test for SQL injection\n```\n\n```\nUse @sqlmap-database-pentesting to automate SQL injection testing\n```\n\n### Phase 3: XSS Testing\n\n#### Skills to Invoke\n- `xss-html-injection` - XSS testing\n- `html-injection-testing` - HTML injection\n\n#### Actions\n1. Test reflected XSS\n2. Test stored XSS\n3. Test DOM-based XSS\n4. Test XSS filters\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @xss-html-injection to test for cross-site scripting\n```\n\n### Phase 4: Authentication Testing\n\n#### Skills to Invoke\n- `broken-authentication` - Authentication testing\n\n#### Actions\n1. Test credential stuffing\n2. Test brute force protection\n3. Test session management\n4. Test password policies\n5. Test MFA implementation\n\n#### Copy-Paste Prompts\n```\nUse @broken-authentication to test authentication security\n```\n\n### Phase 5: Access Control Testing\n\n#### Skills to Invoke\n- `idor-testing` - IDOR testing\n- `file-path-traversal` - Path traversal\n\n#### Actions\n1. Test vertical privilege escalation\n2. Test horizontal privilege escalation\n3. Test IDOR vulnerabilities\n4. Test directory traversal\n5. Test unauthorized access\n\n#### Copy-Paste Prompts\n```\nUse @idor-testing to test for insecure direct object references\n```\n\n```\nUse @file-path-traversal to test for path traversal\n```\n\n### Phase 6: Security Headers\n\n#### Skills to Invoke\n- `api-security-best-practices` - Security headers\n\n#### Actions\n1. Check CSP implementation\n2. Verify HSTS configuration\n3. Test X-Frame-Options\n4. Check X-Content-Type-Options\n5. Verify referrer policy\n\n#### Copy-Paste Prompts\n```\nUse @api-security-best-practices to audit security headers\n```\n\n### Phase 7: Reporting\n\n#### Skills to Invoke\n- `reporting-standards` - Security reporting\n\n#### Actions\n1. Document vulnerabilities\n2. Assess risk levels\n3. Provide remediation\n4. Create proof of concept\n5. Generate report\n\n#### Copy-Paste Prompts\n```\nUse @reporting-standards to create security report\n```\n\n## OWASP Top 10 Checklist\n\n- [ ] A01: Broken Access Control\n- [ ] A02: Cryptographic Failures\n- [ ] A03: Injection\n- [ ] A04: Insecure Design\n- [ ] A05: Security Misconfiguration\n- [ ] A06: Vulnerable Components\n- [ ] A07: Authentication Failures\n- [ ] A08: Software\u002FData Integrity\n- [ ] A09: Logging\u002FMonitoring\n- [ ] A10: SSRF\n\n## Quality Gates\n\n- [ ] All OWASP Top 10 tested\n- [ ] Vulnerabilities documented\n- [ ] Proof of concepts captured\n- [ ] Remediation provided\n- [ ] Report generated\n\n## Related Workflow Bundles\n\n- `security-audit` - Security auditing\n- `api-security-testing` - API security\n- `wordpress-security` - WordPress security\n","# Web Security Testing Workflow\n\n## Overview\n\nSpecialized workflow for testing web applications against OWASP Top 10 vulnerabilities including injection attacks, XSS, broken authentication, and access control issues.\n\n## When to Use This Workflow\n\nUse this workflow when:\n- Testing web application security\n- Performing OWASP Top 10 assessment\n- Conducting penetration tests\n- Validating security controls\n- Bug bounty hunting\n\n## Workflow Phases\n\n### Phase 1: Reconnaissance\n\n#### Skills to Invoke\n- `scanning-tools` - Security scanning\n- `top-web-vulnerabilities` - OWASP knowledge\n\n#### Actions\n1. Map application surface\n2. Identify technologies\n3. Discover endpoints\n4. Find subdomains\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @scanning-tools to perform web application reconnaissance\n```\n\n### Phase 2: Injection Testing\n\n#### Skills to Invoke\n- `sql-injection-testing` - SQL injection\n- `sqlmap-database-pentesting` - SQLMap\n\n#### Actions\n1. Test SQL injection\n2. Test NoSQL injection\n3. Test command injection\n4. Test LDAP injection\n5. Document vulnerabilities\n\n#### Copy-Paste Prompts\n```\nUse @sql-injection-testing to test for SQL injection\n```\n\n```\nUse @sqlmap-database-pentesting to automate SQL injection testing\n```\n\n### Phase 3: XSS Testing\n\n#### Skills to Invoke\n- `xss-html-injection` - XSS testing\n- `html-injection-testing` - HTML injection\n\n#### Actions\n1. Test reflected XSS\n2. Test stored XSS\n3. Test DOM-based XSS\n4. Test XSS filters\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @xss-html-injection to test for cross-site scripting\n```\n\n### Phase 4: Authentication Testing\n\n#### Skills to Invoke\n- `broken-authentication` - Authentication testing\n\n#### Actions\n1. Test credential stuffing\n2. Test brute force protection\n3. Test session management\n4. Test password policies\n5. Test MFA implementation\n\n#### Copy-Paste Prompts\n```\nUse @broken-authentication to test authentication security\n```\n\n### Phase 5: Access Control Testing\n\n#### Skills to Invoke\n- `idor-testing` - IDOR testing\n- `file-path-traversal` - Path traversal\n\n#### Actions\n1. Test vertical privilege escalation\n2. Test horizontal privilege escalation\n3. Test IDOR vulnerabilities\n4. Test directory traversal\n5. Test unauthorized access\n\n#### Copy-Paste Prompts\n```\nUse @idor-testing to test for insecure direct object references\n```\n\n```\nUse @file-path-traversal to test for path traversal\n```\n\n### Phase 6: Security Headers\n\n#### Skills to Invoke\n- `api-security-best-practices` - Security headers\n\n#### Actions\n1. Check CSP implementation\n2. Verify HSTS configuration\n3. Test X-Frame-Options\n4. Check X-Content-Type-Options\n5. Verify referrer policy\n\n#### Copy-Paste Prompts\n```\nUse @api-security-best-practices to audit security headers\n```\n\n### Phase 7: Reporting\n\n#### Skills to Invoke\n- `reporting-standards` - Security reporting\n\n#### Actions\n1. Document vulnerabilities\n2. Assess risk levels\n3. Provide remediation\n4. Create proof of concept\n5. Generate report\n\n#### Copy-Paste Prompts\n```\nUse @reporting-standards to create security report\n```\n\n## OWASP Top 10 Checklist\n\n- [ ] A01: Broken Access Control\n- [ ] A02: Cryptographic Failures\n- [ ] A03: Injection\n- [ ] A04: Insecure Design\n- [ ] A05: Security Misconfiguration\n- [ ] A06: Vulnerable Components\n- [ ] A07: Authentication Failures\n- [ ] A08: Software\u002FData Integrity\n- [ ] A09: Logging\u002FMonitoring\n- [ ] A10: SSRF\n\n## Quality Gates\n\n- [ ] All OWASP Top 10 tested\n- [ ] Vulnerabilities documented\n- [ ] Proof of concepts captured\n- [ ] Remediation provided\n- [ ] Report generated\n\n## Related Workflow Bundles\n\n- `security-audit` - Security auditing\n- `api-security-testing` - API security\n- `wordpress-security` - WordPress security\n",{"name":5,"risk":33,"source":52,"category":53,"date_added":54,"description":7},"personal","granular-workflow-bundle","2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcursor\u002Fweb-security-testing","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill web-security-testing",{"tool":67,"command":68},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill web-security-testing",{"tool":70,"command":71},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill web-security-testing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fweb-security-testing\u002FSKILL.md",true,[],[76,99,125,135,148,165],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":87,"publishedAt":47},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[82],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[88,89,90,91,92,93,94,95,28,96,97,98],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","official","fetch","with",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":47},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[106,107,108,109,110,111,90,112,113,114,115,116,117,118,119,120,121,122,123,124],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","data","google","install","read","across","api",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":47},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[132,133,106,117,118,119,120,110,90,122,134,123,124,116,114,113,112,121,111,109],"trend radar","radar","pulse",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":47},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[142,143,144,145,146,147],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":157,"publishedAt":47},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[154],{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",[150,28,158,159,160,98,117,161,162,163,108,164,121],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":47},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[167,172,173,174,121,175,162,176,177,37,178,179],"status","play","go","latest","github","discover","cmd","volume"]