Webassessment

What it does

The Webassessment skill provides a security assessment infrastructure for websites, integrating reconnaissance, threat modeling, and vulnerability testing. It analyzes website content to identify potential vulnerabilities and attack scenarios. Crucially, before any action is taken, a voice notification must be sent to alert the user about the workflow being executed.

When to use it

This skill is useful in the following situations:

• Performing security assessments on web applications.
• Developing threat models for websites and online services.
• Identifying potential vulnerabilities through reconnaissance and testing.
• Analyzing website content for attack scenarios.
• Investigating bug bounty programs.

Key capabilities

• Workflow Routing: Directs assessment tasks to specialized skills (e.g., Recon, PromptInjection, OSINT).
• Reconnaissance Integration: Leverages tools from the Recon skill for corporate structure and subdomain enumeration.
• Threat Modeling: Creates attack scenarios and prioritizes testing efforts.
• Vulnerability Analysis: Uses AI, specifically Gemini analysis, to identify vulnerabilities.
• Browser Automation Testing: Integrates with Playwright for automated web application testing.
• Mandatory Voice Notification: Requires a notification before any action is taken.

Example prompts

Here are some example prompts that could trigger the Webassessment skill:

• "Threat model this website."
• "Test this web app for vulnerabilities."
• "Perform reconnaissance on target.com."
• “What does this application do?”

Tips & gotchas

• Mandatory Notification: You must send the specified voice notification using the provided curl command immediately upon skill invocation. Failure to do so will prevent the skill from functioning correctly.
• Customization: User customizations can be found and applied at ~/.claude/PAI/USER/SKILLCUSTOMIZATIONS/WebAssessment/.