Common AppSec Patterns
Orchestrator that fans out XSS, CSRF, injection and prototype-pollution testing subagents
Test report
- Verdict
- Tested · Didn't pass
- Tested
- Jul 17, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · ca532dc
This skill is a pure orchestrator whose only tool is Task and whose sole job is to spawn xss-tester, csrf-tester, injection-tester, prototype-pollution-tester and csp-bypass-tester. Installed as a lone catalog skill none of those subagents come with it (they live in plugins/pentest/agents/, not the skill dir), so standalone it is inert and would try to launch subagent types that do not exist. It only works if you install the entire pentest plugin, and even then it never performs analysis itself, so as a single skill it cannot beat an agent doing the appsec review directly.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 3/10
- Docs & honesty 4/5
What Common AppSec Patterns does
A coordinator skill that delegates common web-vulnerability testing (XSS, CSRF, SQL/NoSQL/command injection, prototype pollution, CSP bypass) to specialized subagents from the pentest plugin. Triggers when the user asks to run an application security assessment or test for OWASP Top 10 issues.
How to install Common AppSec Patterns
git clone https://github.com/Stickman230/claude-pentest
mkdir -p ~/.claude/skills
cd claude-pentest && cp -r plugins/pentest/skills/common-appsec-patterns ~/.claude/skills/common-appsec-patterns
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Common AppSec Patterns
-
/common-appsec-patternsOrchestrator that fans out XSS, CSRF, injection and prototype-pollution testing subagents
It also activates on plain-language prompts like these:
-
run a full appsec assessment on my web app for XSS and CSRF -
test my site for SQL injection and prototype pollution issues -
check my application against the OWASP Top 10 vulnerabilities
Frequently asked questions
- Is the Common AppSec Patterns skill free?
- Yes. The skill itself is free from Stickman230/claude-pentest. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Common AppSec Patterns work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 17, 2026. Verdict: Tested · Didn't pass. This skill is a pure orchestrator whose only tool is Task and whose sole job is to spawn xss-tester, csrf-tester, injection-tester, prototype-pollution-tester and csp-bypass-tester. Installed as a lone catalog skill none of those subagents come with it (they live in plugins/pentest/agents/, not the skill dir), so standalone it is inert and would try to launch subagent types that do not exist. It only works if you install the entire pentest plugin, and even then it never performs analysis itself, so as a single skill it cannot beat an agent doing the appsec review directly.
- How do I install Common AppSec Patterns?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Common AppSec Patterns with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.