web-infra-vapt-skill

Here's a full description you can paste into that box:

Web & Infra VAPT turns your AI coding agent into a methodical, safety-first penetration tester. It codifies a professional VAPT workflow — passive recon → active enumeration → analysis → reporting — so the agent scans in the right order, maps findings to the OWASP Top 10, correlates them into real attack chains, and hands back a prioritized, remediation-focused report instead of raw tool dumps.

Prerequisites

• Node.js ≥ 20 (to install via the qaskills CLI)
• Standard open-source security tools on PATH as needed: nmap, nuclei, sqlmap, nikto, testssl.sh, OWASP ZAP, ffuf/gobuster, subfinder, ssh-audit
• Written authorization to test the target (the skill enforces an authorization-first rule)

What it covers

• 6-phase methodology: reconnaissance, network enumeration, web application testing, infrastructure hardening, attack-chain correlation, and reporting
• OWASP Top 10 (2021) mapping for every finding
• 10 modeled attack chains (e.g. SQLi → data exfiltration, anon FTP → RCE, stored XSS → account takeover)
• Reporting format with CVSS severity bands and copy-pasteable remediation
• Best practices and anti-patterns (passive-before-active, deliberate escalation, false-positive verification)

Install

npx @qaskills/cli add web-infra-vapt-skill

Example usage

Ask your agent: "Run an authorized assessment of https://staging.example.com." It will confirm scope, start with passive recon (whois, DNS, subdomains), do a light nmap sweep before escalating, check TLS and security headers, run targeted nuclei/sqlmap probes on parameterized inputs, correlate results into attack chains, and produce an OWASP-mapped report ordered by severity.

Safety

Authorization-first by design — the skill refuses to scan targets the user doesn't own or have written permission to test, and warns before running intrusive scans against production.