The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python utility scripts intended for local execution by the agent to support the auditing workflow. The scripts/wstg_checklist.py script generates and scores security checklists based on the WSTG methodology. The scripts/wstg_lookup.py script allows for querying WSTG test IDs and categories.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an inherent attack surface as it is designed to ingest and analyze untrusted source code and repository metadata for security vulnerabilities. Ingestion points: The agent reads user-provided codebases, configuration files, and git history to perform sweeps for vulnerabilities (CODEBASE-AUDIT.md). Boundary markers: The audit protocol mandates building a route table and data-access inventory before evaluation, providing a structured approach to analyzing untrusted input (CODEBASE-AUDIT.md). Capability inventory: The skill uses local scripts to manage tracking data and provides instructions for the agent to perform manual searches for secrets and logic flaws. Sanitization: The instructions focus on reporting findings based on specific patterns rather than executing the code under review.
[EXTERNAL_DOWNLOADS]: The skill references external security resources and documentation from established organizations. It links to the official OWASP WSTG project website and GitHub repository for the source of truth regarding security tests. It refers users to vetted security research platforms like PortSwigger Web Security Academy for further detection techniques.

wstg-security-testing