Web App Security Inspection

Use this skill after engagement-scope has established the authorized target, scope evidence, impact tolerance, accounts/roles, and desired deliverable. If no engagement brief is present, infer local/read-only scope from the workspace or ask only for the missing boundary that changes whether live testing is allowed.

Prefer the Codex browser use feature for exploration and validation. Fall back to Chrome DevTools Protocol (CDP) only when browser use lacks the control needed for network interception, storage inspection, service worker state, WebSockets, HAR-style capture, request mutation, console/runtime collection, or precise device/emulation behavior.

Current Trend Bias

Recent web-app security sources emphasize: