The Agent Skills Directory

[SAFE]: The skill serves as a structured documentation of a 12-phase security auditing methodology. It uses well-known, industry-standard command-line tools such as nmap, curl, ffuf, and httpx to perform authorized testing.
[SAFE]: The automated scanner alerts regarding curl commands are evaluated as false positives. The command `curl -sS -D
--max-time 10 "https://${TARGET}/" -o /dev/null fetches HTTP headers for inspection while discarding the response body into the null device (/dev/null`), which prevents any execution of remote content.
[SAFE]: Network operations are restricted to the user-supplied ${TARGET} variable. There are no hardcoded malicious domains or patterns indicating data exfiltration to unauthorized third parties.
[SAFE]: The skill does not attempt to obfuscate its instructions, nor does it contain any mechanisms for privilege escalation or persistence on the host system. It follows security best practices by recommending the use of test accounts and advising against testing on production data.

wstg-web-pentest