Security & Auditing Skills

Perform dynamic security validation on explicitly authorized web targets, covering authentication, authorization, object ownership, tenant isolation, state transitions, and business rules, and reach strict conclusions using reproducible evidence, verified impact, and structured state. Use when the user provides an authorized web target and asks for penetration testing, a vulnerability assessment, or validation of web security boundaries. Do not use for unauthorized targets, social engineering, mobile-only testing, infrastructure scanning, or general security advice without a concrete authorized web target.

A Web security assessment workflow built on globally installed Chrome DevTools MCP and Burp MCP. It establishes real browser state, synchronizes Burp evidence, models endpoints and permissions, validates vulnerabilities endpoint by endpoint, and completes threat convergence. It outputs structured data only.

Authorized security testing methodology for web apps, APIs, multi-tenant SaaS, Spring Boot / Cloud Gateway stacks, FIDO/WebAuthn passwordless auth, mobile backends, and OAuth/SSO integrations. Use whenever the user asks to test, probe, scan, find vulnerabilities in, or pentest any web service — including bug bounty engagements, authorized pentests, CTF challenges, post-patch re-verification, CVSS scoring, subdomain/asset discovery, WAF/auth-filter bypass, authorization bypass / IDOR / broken access control / missing @PreAuthorize / privilege escalation testing, FIDO2/UAF testing, token-chain analysis, or writing vulnerability reports. Also triggers on the words "AcmeAuth", "Keycloak", "Okta", "PingFederate", "Auth0", or any passwordless-auth vendor. This is a defensive skill for authorized work only — always confirm scope before any active test.