Security Tester

Security testing for web applications and APIs based on OWASP standards. Identify common vulnerabilities (injection, auth bypass, XSS, CSRF, IDOR), generate...

This skill appears to be a legitimate OWASP-based security-testing guide, but take these precautions before installing or running it: - Only run tests against targets you own or have explicit authorization to test. Many included checks are intrusive (SQLi payloads that include 'DROP TABLE', brute-force login attempts, DoS-style loops, SSRF tests targeting cloud metadata) and can cause data loss, account lockout, or legal issues. - The SKILL.md expects runtime inputs (URL, bearer tokens, JWTs, API tokens) and uses tools (python3, base64, nmap, openssl) but the registry metadata does not declare these environment variables or binary requirements — the skill will implicitly depend on them. Ask the publisher to explicitly list required env vars and binaries. - Consider running tests in a safe staging environment or with rate limits and non-destructive payloads first. Remove obviously destructive payloads (e.g., DROP TABLE) from automated runs. - If you allow autonomous invocation, restrict its scope or disable autonomous execution until you confirm what inputs it will use. Autonomous operation combined with undisclosed credentials/targets increases risk. - Verify legal/organizational approval and have backups/incident contacts ready before running active tests. If you need higher confidence, request the publisher to add a clear requires.env section, explicit warnings about destructive tests, and non-destructive default test mode.