Security Review

This is a proper penetration testing workflow that actually opens a browser and validates security issues at runtime, not just static analysis. It walks through OWASP Top 10 checks with real evidence: submitting XSS payloads to see if they render, testing JWT tampering, verifying HttpOnly flags on cookies, attempting CSRF attacks. The phased approach (educate, scope, analyze, report, remediate) means you get findings with CVE references and confidence scores, plus YAML regression tests to prevent backsliding. Use it before launches, after auth changes, or when handling payment data. It catches the stuff that only shows up in a live browser: misconfigured headers, insecure token storage, broken access controls.

Install to Claude Code

npx -y skills add shiplightai/agent-skills --skill security-review --agent claude-code