security-testing SKILL.md skillA
security-testing from joe-qai/qa-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add joe-qai/qa-skills/security-testing@git:20260915.bc5a8d6Pins git:20260915.bc5a8d6 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- joe-qai/qa-skills
- Path
security-testing/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260915.bc5a8d6, committed Sep 15, 2026
- First version recorded
- Sep 7, 2026
- Size
- 3,414 bytes
- Repository stars
- 30
- License
- none declared
Use this skill when you need to generate a concrete security scan plan with OWASP-aligned checks, vulnerability checklist, and remediation steps; triggers include 安全测试, 安全扫描, 渗透测试, security testing, and security scan.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 安全测试 ## 何时使用 - 用户提供系统架构或接口信息，需要生成**可执行的安全扫描方案**。 - 需要围绕 OWASP Top 10、认证授权、数据保护做安全验证。 ## 输入要求 | 必填 | 字段 | 说明 | |------|------|------| | ✅ | 系统范围 | 应用类型（Web/API/移动端）、核心模块 | | ✅ | 认证方式 | 登录机制、Token 类型、权限模型 | | ⬜ | 接口清单 | API 路径、参数、错误码 | | ⬜ | 敏感数据 | PII、密钥、支付信息的位置和流向 | | ⬜ | 已知问题 | 历史漏洞、近期变更、安全事件 | ## 执行流程 ### 1. 输入审计 - 检查系统范围是否明确（哪些模块需要测试） - 检查认证方式是否描述完整 - 缺失信息标记为「假设」 ### 2. 攻击面识别 基于输入识别安全风险： | 风险类别 | 检查内容 | 优先级 | |----------|---------|--------| | 认证 | 暴力破解、凭证填充、会话固定 | P0 | | 授权 | 水平越权、垂直越权、IDOR | P0 | | 输入处理 | XSS、SQL 注入、命令注入、SSRF | P0 | | 敏感数据 | PII 泄露、密钥暴露、日志敏感信息 | P0 | | 会话 | Token 过期、CSRF、Cookie 安全属性 | P1 | | 配置 | 默认凭证、调试模式、CORS、安全头 | P1 | | 依赖 | 已知 CVE、过时组件、供应链风险 | P1 | ### 3. 检查项生成 为每个风险类别生成具体检查项，格式： ```markdown ## [P0] SEC-<类别>-<序号>: <检查项标题> [风险类别] 认证 [检查方法] <具体的测试步骤> [预期安全行为] <系统应有的安全响应> [风险描述] <如果不通过的安全影响> [修复建议] <通过后的修复方向> [验证方式] 手动 / 自动化脚本 ``` ### 4. 检查项校验 生成后必须执行以下校验： - [ ] 覆盖 OWASP Top 10 中至少 5 个类别 - [ ] 每个 P0 风险类别至少有 2 条检查项 - [ ] 检查方法具体可执行（非泛泛描述） - [ ] 有「预期安全行为」和「风险描述」 - [ ] 至少覆盖 1 条认证 + 1 条授权 + 1 条输入处理 - [ ] 不含攻击利用细节（防守导向） ### 5. 输出交付物 | 文件 | 内容 | |------|------| | `security-scan-plan.md` | 完整扫描方案（含攻击面、检查项、优先级） | …
Read the whole file at its exact version.
How to install
mdr add joe-qai/qa-skills/security-testing@sha256:beffff558e5cd50aThe line at the top of this page pins the label git:20260915.bc5a8d6, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_cdio63d7qmqwc7l6)
7 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Sep 7, 2026 and Sep 15, 2026, about one every 8 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260915.bc5a8d6 latest | 2026-09-15 | bc5a8d6 | 3,414 B | A | view · diff |
| git:20260907.af8ce9d | 2026-09-07 | af8ce9d | 2,667 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (3414 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
joe-qai/qa-skills · 30 stars · license none declared · pushed 2026-09-29 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_cdio63d7qmqwc7l6 GET https://markdownregistry.com/api/v1/resolve?ref=joe-qai/qa-skills/security-testing GET https://markdownregistry.com/api/v1/blob/beffff558e5cd50ae3e6d026fb52747989c5e8f95d0c89ac5d3a660ee8f85658
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from joe-qai/qa-skills
Every file in joe-qai/qa-skills