security-testing
将多层安全检查自动化到 PR 流程，显著降低常见安全风险。
会运行扫描器并可能触发外部网络访问，需在受控环境执行。
把 OWASP Top10 与 SAST/DAST/依赖扫描纳入 CI，覆盖常见注入与认证缺陷。
把 OWASP Top10 的自动化检测纳入 CI：DAST（如 OWASP ZAP）、SAST（Semgrep）、依赖/供应链扫描（OSV‑Scanner、SBOM）以及用 Playwright 做 XSS/CSRF/SSRF 等负向路径测试。适合在每次 PR 都要防止注入、权限绕过或依赖漏洞时把安全检查常态化。特点是多层次组合（SCA+SAST+DAST+E2E），强调覆盖负面场景而非只跑 happy path。
▸ 展开 SKILL.md 英文原文
Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-sy
帮我安装这个 skill：https://raw.githubusercontent.com/petrkindlmann/qa-skills/main/skills/security-testing/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/petrkindlmann/qa-skills/main/skills/security-testing/SKILL.md"<objective> A login test that only checks the happy path passes while an expired JWT still grants admin, an IDOR lets user A read user B's orders, and a webhook field reaches `169.254.169.254`. This skill forces the negative-path checks — broken access control, injection, SSRF, auth bypass, supply-chain drift — into CI on every PR, layered across DAST, SCA, SAST, and custom Playwright tests so no single tool's blind spot ships. It produces runnable tests mapped to the OWASP Top 10 (2025) plus the CI gates that fail the build when a category regresses. </objective> ## Discovery Questions Check `.agents/qa-project-context.md` first — if it exists, use it and skip anything already answered th