🛡️ Security Testing Skill

A portable AI agent skill for security testing web applications. Uses PayloadsAllTheThings (~79k ⭐) as its payload reference database, wrapped in a structured workflow that integrates with your development process.

What This Does

When your AI coding agent builds features that handle user input, authentication, file uploads, databases, or APIs — this skill kicks in and ensures security vulnerabilities are caught before deployment.

It provides:

• 🔍 Attack surface identification — maps feature types to vulnerability categories
• 🧪 Ready-to-use test templates — TypeScript security test patterns for 13+ vulnerability types
• 📋 Structured workflow — Identify → Select → Write → Run → Verify
• 🎯 Next.js priority matrix — P0–P3 ranked security concerns
• 🔗 PayloadsAllTheThings integration — every category links to its PAT section

Vulnerability Categories Covered

Category	Payloads	Test Template
XSS (Cross-Site Scripting)	✅	✅
SQL Injection	✅	✅
NoSQL Injection	✅	✅
CSRF	✅	✅
SSRF	✅	✅
Path Traversal / LFI	✅	✅
JWT Attacks	✅	✅
IDOR	✅	✅
File Upload	✅	✅
Security Headers	—	✅
CORS Misconfiguration	✅	✅
Command Injection	✅	—
SSTI	✅	—
Rate Limiting	—	✅

Plus quick-reference links for GraphQL, XXE, OAuth, Race Conditions, Prompt Injection, and more.

Installation

Quick Install (any agent)

git clone https://github.com/3L1AS/security-testing-skill.git

Then copy the files to your agent's skills directory:

Agent	Global Path	Project Path
Antigravity	~/.gemini/config/skills/security-testing/	.agents/skills/security-testing/
Claude Code	~/.claude/skills/security-testing/	.claude/skills/security-testing/
Claude Desktop	Zip folder → Upload via Customize > Skills	—
GitHub Copilot	—	.github/skills/security-testing/
Cursor	~/.cursor/skills/security-testing/	.cursor/skills/security-testing/
Gemini CLI	~/.gemini/config/skills/security-testing/	.agents/skills/security-testing/
Opencode	Check docs	.agents/skills/security-testing/

Example: Claude Code

git clone https://github.com/3L1AS/security-testing-skill.git
mkdir -p ~/.claude/skills
cp -r security-testing-skill/ ~/.claude/skills/security-testing/

Example: Project-wide (team)

# Everyone on the project gets the skill automatically
mkdir -p .agents/skills
cp -r security-testing-skill/ .agents/skills/security-testing/

Fallback: AGENTS.md

If your agent doesn't support SKILL.md discovery, paste the contents of SKILL.md into your project's AGENTS.md file.

Files

File	Purpose
SKILL.md	Main skill — workflow, checklists, Next.js priority matrix
security-reference.md	Payload reference — categorized payloads + test templates

How It Works

The skill follows the agentskills.io open standard:

1. Discovery — Your agent reads the skill's name and description at startup
2. Activation — When you're building a feature that matches (user input, auth, APIs, etc.), the agent loads the full SKILL.md
3. Execution — The agent follows the 5-step workflow, pulling payloads from security-reference.md as needed

Based On

• PayloadsAllTheThings — The industry-standard payload reference (~79k ⭐)
• agentskills.io — The open specification for portable AI agent skills

License

MIT — use it, share it, improve it.