web-app-security
End-to-end security program for a web app — scope/authorization gate, frontend exposure reduction, API security (IDOR/BOLA, brute force,…
Testing what is locked and what isn’t
What it does
A phased program for auditing and hardening a production web app. Phases are ordered so that cheap read-only work happens before anything that touches production, and so findings arrive in the order a small team can actually fix them.
What it can touch
Includes 251 scripts
Your AI can run these when the skill is used — on your computer in a coding tool (which asks first unless you have told it not to), or in the AI’s own sandbox in Claude and ChatGPT.
How we know
Found in the skill’s folder: .github/scripts/run-self-audit.mjs, examples/insecure-demo/src/export-report.mjs, examples/insecure-demo/test-functional.mjs, examples/quickstart/after/app/api/health/route.ts….
Uses terminal commands
It shows your AI commands to run. In a coding agent that means your terminal; in a chat app it usually can’t.
How we know
The SKILL.md contains shell code blocks.
Reads credentials or your environment, and sends data over the internet
Files like these hold passwords and keys. A skill rarely needs them, and reading them while also sending data out is how secrets get stolen.
How we know
scripts/crawl-surface-audit.mjs line 245: “'/.env', '/.git/config', '/.git/HEAD', '/.aws/credentials', '/.DS_Store', → const res = await http.request(url, {”. Read 2026-10-05, commit 4f03cfc.
scripts/crawl-surface-audit.mjs, line 245 ↗9 smaller things worth knowing
Tells your AI to hide what it does from you; Contains commands that delete or overwrite; Refers to a credentials file (SSH keys, cloud logins, tokens); Contacts a server by raw IP address. Usually legitimate — listed so nothing is hidden.
How we know
Tells your AI to hide what it does from you — docs/V0.8.1_ENGINEERING_PLAN.md line 891; Contains commands that delete or overwrite — docs/release-process.md line 61; Contains commands that delete or overwrite — references/deploy-safety.md line 44; Refers to a credentials file (SSH keys, cloud logins, tokens) — references/enforcement-layers.md line 9; Refers to a credentials file (SSH keys, cloud logins, tokens) — references/phase-2-api.md line 98; Contains commands that delete or overwrite — scripts/bootstrap-install.sh line 54. Read 2026-10-05, commit 4f03cfc.
docs/V0.8.1_ENGINEERING_PLAN.md, line 891 ↗docs/release-process.md, line 61 ↗references/deploy-safety.md, line 44 ↗references/enforcement-layers.md, line 9 ↗references/phase-2-api.md, line 98 ↗scripts/bootstrap-install.sh, line 54 ↗Recently maintained
Its repository has had changes recently.
How we know
Last push to parousia8888/web-app-security-skill: 2026-10-04 (1 days before the scan).
Read automatically from the skill’s own files on GitHub on 5 Oct 2026. Launch7 does not run or manually review skills: this lists what the check saw, and nothing here means “safe”. How we check
Add it to your AI
Partly. Upload it in Claude’s settings — the instructions work; the scripts need the full folder.
Built in your browser from the SKILL.md on GitHub — nothing passes through Launch7.
In Claude, open Customize → Skills, press +, then Create skill → Upload a skill, and choose the .zip.
Make sure code execution is switched on (Settings → Capabilities). Skills need it.
Start a new chat and ask for the job in your own words — Claude picks the skill up when it fits.
This skill ships 251 scripts beside its instructions. The download here is the SKILL.md alone — enough for the instructions, not for the parts that run code. Use the command route, or take the full folder from the repository.
How Claude does this: support.claude.com · checked 28 Sep 2026 · “Supported” means documented by the vendor; Launch7 has not run it end to end
Worth knowing
- It can only read. Nothing it does changes anything on the other side.