Skip to content

Test Skills

17 test skills covering the full OWASP Top 10 (2025), PortSwigger Academy, and cutting-edge attack techniques.

Skills Taxonomy

graph TB
    ROOT["17 Test Skills<br/>31 Scoped Sub-agents + 7 Non-Scoped"]

    SCOPED["10 Scoped Skills<br/>31 Sub-agents"]
    NONSCOPED["7 Non-Scoped Skills<br/>Monolithic or Flag-gated"]

    ROOT --> SCOPED
    ROOT --> NONSCOPED

    SCOPED --> INJ["Injection<br/>5 scopes"]
    SCOPED --> AUTH["Auth<br/>3 scopes"]
    SCOPED --> ACC["Access<br/>3 scopes"]
    SCOPED --> SSRF["SSRF<br/>2 scopes"]
    SCOPED --> LOG["Logic<br/>3 scopes"]
    SCOPED --> API["API<br/>3 scopes"]
    SCOPED --> ADV["Advanced<br/>4 scopes"]
    SCOPED --> INF["Infra<br/>2 scopes"]
    SCOPED --> CLD["Cloud<br/>3 scopes"]
    SCOPED --> CLI["Client<br/>3 scopes"]

    NONSCOPED --> CRY["Crypto"]
    NONSCOPED --> EXC["Exceptions"]
    NONSCOPED --> SUP["Supply Chain"]
    NONSCOPED --> DES["Deserialization"]
    NONSCOPED --> LLM["LLM<br/>--llm flag"]
    NONSCOPED --> MOB["Mobile<br/>--mobile flag"]
    NONSCOPED --> W3["Web3<br/>--web3 flag"]

    style ROOT fill:#9b30ff,color:#fff,stroke:#00e5ff,stroke-width:3px
    style SCOPED fill:#4a148c,color:#fff
    style NONSCOPED fill:#6a1b9a,color:#fff
    style INJ fill:#7b1fa2,color:#fff
    style AUTH fill:#7b1fa2,color:#fff
    style ACC fill:#7b1fa2,color:#fff
    style SSRF fill:#7b1fa2,color:#fff
    style LOG fill:#7b1fa2,color:#fff
    style API fill:#7b1fa2,color:#fff
    style ADV fill:#7b1fa2,color:#fff
    style INF fill:#7b1fa2,color:#fff
    style CLD fill:#7b1fa2,color:#fff
    style CLI fill:#7b1fa2,color:#fff
    style CRY fill:#8e24aa,color:#fff
    style EXC fill:#8e24aa,color:#fff
    style SUP fill:#8e24aa,color:#fff
    style DES fill:#8e24aa,color:#fff
    style LLM fill:#9c27b0,color:#fff
    style MOB fill:#9c27b0,color:#fff
    style W3 fill:#9c27b0,color:#fff

Scoped Skills (10 skills, 31 sub-agents)

Skill Scopes Total Scopes
Injection sqli, xss, cmdi, ssti-xxe, misc 5
Auth jwt, oauth, session 3
Access Control idor, authz, matrix 3
SSRF core, vector 2
Business Logic business, race, upload 3
API Security rest, graphql, prototype 3
Advanced hpp-crlf, bypass, mfa, host-method 4
Infrastructure smuggling, cache 2
Cloud storage, takeover, k8s-cicd 3
Client-Side csrf-cors, dom, misc 3

Non-Scoped Skills

Skill Coverage
Crypto TLS/SSL, cryptographic failures
Exceptions Stack traces, debug mode
Supply Chain Dependencies, SRI, Docker secrets
Deserialization Java, PHP, .NET, Python, Ruby
LLM Prompt injection, MCP attacks (requires --llm)
Mobile Android/iOS (requires --mobile)
Web3 Reentrancy, flash loan, oracle, access control, MEV (requires --web3)

Utility Skills

See Utility Skills for: /intake, /walkthrough, /route, /verify, /chain-findings, /report, /dashboard, /retest, /diff-engagements.