Web Application Security Testing
OWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting…
Testing what is locked and what isn’t
What it does
Enable Claude to assist with comprehensive web application security assessments covering OWASP Top 10, injection testing, API security, authentication analysis, and client-side security. Claude analyzes application behavior, generates test payloads, reviews source code, and produces structured vulnerability reports.
What it can touch
Includes 2 scripts
Your AI can run these when the skill is used — on your computer in a coding tool (which asks first unless you have told it not to), or in the AI’s own sandbox in Claude and ChatGPT.
How we know
Found in the skill’s folder: scripts/api_security_tester.py, scripts/owasp_scanner.py; binary files: scripts/__pycache__/owasp_scanner.cpython-314.pyc.
Asks for an API key or token
You will need an account with the service it talks to, and your own key. Keep keys in your settings or environment, never in a chat.
How we know
The SKILL.md mentions an API key or access token.
Mentions 8 outside web addresses
The instructions point your AI at these sites or APIs. Anything it sends there leaves your computer.
How we know
Web addresses in the SKILL.md, excluding GitHub and documentation sites: api.target.com, book.hacktricks.xyz, evil.com, evil.target.com, localhost.evil.com….
Installs other software
Following it will install packages (npm, pip, brew or similar). Those come from their own publishers, not from this skill.
How we know
The SKILL.md contains package-install commands.
3 smaller things worth knowing
Refers to a credentials file (SSH keys, cloud logins, tokens); Contacts a server by raw IP address; Contains commands that delete or overwrite. Usually legitimate — listed so nothing is hidden.
How we know
Refers to a credentials file (SSH keys, cloud logins, tokens) — SKILL.md line 199; Contacts a server by raw IP address — SKILL.md line 199; Contains commands that delete or overwrite — scripts/owasp_scanner.py line 46. Read 2026-10-04, commit 42e1501.
SKILL.md, line 199 ↗SKILL.md, line 199 ↗scripts/owasp_scanner.py, line 46 ↗Partly checked
Launch7’s check could not read everything in this skill: 1 compiled program file it cannot read. Nothing is known about the parts it skipped.
How we know
4 text files read; skipped files are listed by name only. Read 2026-10-04, commit 42e1501.
Recently maintained
Its repository has had changes recently.
How we know
Last push to Masriyan/Claude-Code-CyberSecurity-Skill: 2026-09-07 (27 days before the scan).
Read automatically from the skill’s own files on GitHub on 4 Oct 2026. Launch7 does not run or manually review skills: this lists what the check saw, and nothing here means “safe”. How we check
Add it to your AI
Partly. Upload it in Claude’s settings — the instructions work; the scripts need the full folder.
Built in your browser from the SKILL.md on GitHub — nothing passes through Launch7.
In Claude, open Customize → Skills, press +, then Create skill → Upload a skill, and choose the .zip.
Make sure code execution is switched on (Settings → Capabilities). Skills need it.
Start a new chat and ask for the job in your own words — Claude picks the skill up when it fits.
This skill ships 2 scripts beside its instructions. The download here is the SKILL.md alone — enough for the instructions, not for the parts that run code. Use the command route, or take the full folder from the repository.
How Claude does this: support.claude.com · checked 28 Sep 2026 · “Supported” means documented by the vendor; Launch7 has not run it end to end
More from Masriyan
All from this publisher →- Cryptographic Analysis & Assessment
SSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness…
- CSOC Operations & Playbook Automation
SOC alert triage, incident playbook automation, escalation workflows, shift reporting, and SOC KPI tracking
- Exploit Development & Payload Engineering
Proof-of-concept development, payload crafting, shellcode analysis, and exploitation technique research for authorized security testing
- GRC & Compliance
Governance, risk, and compliance — risk assessment and scoring, control mapping across NIST CSF 2.0 / ISO 27001:2022 / SOC 2 / CIS Controls…
- Incident Response & Digital Forensics
IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP…
