Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Before & after
Same prompt, same agent — the only difference is the skill.
Security testing is definitely important before launch. You'd want to check for common issues, test your authentication, maybe scan dependencies. There are tools that can help, but it depends on your tech stack and how thorough you want to be. What type of application are you building?
SECURITY VULNERABILITY REPORT: EXECUTIVE SUMMARY: 3 High-risk, 7 Medium-risk, 4 Low-risk issues found. Recommend delaying launch 1 week for High fixes. OWASP TOP 10 MAPPING: CRITICAL (Fix before launch): 1. SQL Injection in search endpoint → Query: /api/search?q='; DROP TABLE users; -- → Impact: Full database compromise → Fix: Use parameterized queries → Time: 2 hours 2. Broken Authentication → JWT tokens never expire (default forever) → Session hijacking risk if token leaked → Fix: Add 7-day expiry + refresh token rotation → Time: 4 hours 3. Insecure Deserialization in upload handler → Uploaded pickle files auto-deserialize → Allows RCE (remote code execution) → Fix: Reject pickle, use JSON only → Time: 1 hour HIGH: • XSS in user profile (stored) → Sanitize all HTML input • Missing CSRF tokens on forms → Add token validation • Hardcoded API keys in code → Rotate, move to env vars • No rate limiting on login → Add 5-attempt cap + 15m lockout MEDIUM: • Weak password policy (6 chars min) → Enforce 12+ chars + complexity • Missing security headers (HSTS, CSP) → Add to all responses DEPENDENCY SCAN: • Django 3.1 (EOL, has 3 CVEs) → Update to 4.2 • lodash 4.17.15 → Update to 4.17.21+ SCHEDULE: High fixes (7h total) end of week → re-test Monday → green light launch Tuesday.
About this skill
“The scanner flagged dozens of issues. Which ones can actually hurt us?” Assess application and API security by tracing reachable attack paths, testing permission boundaries, and separating confirmed vulnerabilities from leads that still need validation. Turn the evidence into fixes engineers can implement and retest.
What it does
- Maps endpoints, authentication flows, sensitive data, and trust boundaries before choosing tests.
- Tests cross-account and cross-tenant access with controlled accounts and explicit expected outcomes.
- Reviews injection paths, dependency advisories, and suspected secrets without treating scanner matches as proven exploits.
- Checks API field exposure, writable properties, session handling, and sensitive workflow abuse.
- Ranks findings by demonstrated access, affected data, prerequisites, and confidence.
- Produces minimal reproduction steps, code-specific remediation, and regression tests for each actionable finding.
What you get
A scoped assessment with prioritized findings, sanitized evidence, a fix plan, and explicit coverage limits. For a single suspicious endpoint or scanner result, you get a focused verdict and the next discriminating test instead of a full report.
Best for
Application engineers, API owners, and security reviewers preparing a release, investigating scanner findings, or validating fixes on systems they are authorized to assess.
SKILL.md preview
---
name: application-penetration-test-and-fix-plan
description: Assess application and API security through attack-surface mapping, source-to-sink tracing, controlled permission tests, dependency triage, and evidence-backed remediation. Use when the user says "pentest this application", "audit our API before launch", "check our OWASP exposure", "can one customer access another customer's data?", "our scanner keeps flagging everything", "check whether these credentials leaked", or "verify the security fixes".
---
# Application Penetration Test and Fix Plan
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.
LLM App and Agent Security Assessment
Threat-model an LLM app or agent: map injection paths, rate tool blast radius, and get architectural fixes plus canary tests.