Webapp Testing Checklist

Draft · awaiting review

Agent skill that walks an authorized web application test through the OWASP WSTG checklist and writes a findings report.

For Web and API testingWorks with Claude CodeMaintained AccessITGroup, last push 2026-09-03

SkillA skill is a set of instructions, and sometimes scripts, that your AI client loads when a task needs it. by AccessITGroup · read from the code at d79e594 on 2026-10-21The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

Level 3. Persistence. After the statement of work and a real-time go-ahead the agent may create a user account in the target application, which is a new user on the target and therefore level 3.
SKILL.md L233-240
Level 2. Files. The agent writes the requests and responses it sent into ~/wstg-evidence/ in the home directory, outside the working directory.
SKILL.md L146-148
Level 2. Execution. Report conversion is left to whatever document tooling the environment offers, with no fixed list of programs.
SKILL.md L174-176
Level 2. Secrets. The agent reads a plain-text file with several test accounts and their passwords from the working directory.
SKILL.md L43-52
No evidence. Approval. Unknown: no allowed-tools, settings or auto-mode instructions were found, but the search patterns for approvals match one line in SKILL.md, so a zero cannot be written. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

Claude Code: permissions.allow: [Read, Grep]; keep Bash, Write and WebFetch on ask, and keep test-credentials.txt and ~/wstg-evidence/ out of synced or shared folders.

What we checked, and what we found Disagree?

Skill · code showsreach 3 · privileged

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for: Structures an authorized web application penetration test around the OWASP WSTG methodology and tracks checklist coverage.
Turns tester-supplied evidence into a findings report with WSTG-numbered IDs.
Asks a diagnostic question per WSTG test and interprets the evidence the tester hands over, including raw Burp/ZAP captures.
Use it when: Plan, scope or track a web application pentest against the WSTG checklist Web and API testing
Produce a findings report with WSTG IDs in Markdown, Word (.docx) or PDF Web and API testing
Assess tester-supplied request/response evidence against a WSTG test's criteria and record the verdict Finding validation
Walk an API-only target through API Testing plus the API-relevant tests from Authentication, Session, Input Validation and Business Logic Web and API testing
Not for: The author rules out payloads, injection strings, exploit attempts and scanners; benign traffic is allowed and the tester does the actual security testing.
Meant as a workflow aid for testers who are already authorized, not as a safeguard against unauthorized use.
Covers dynamic/black-box testing only; the report recommends a separate source code security review when that is in the SOW and source access is given.
You need: Claude Code, with the skill installed from the AITG-hub marketplace or directly
Written authorization to test the specific target, such as a signed SOW or pentest agreement
Named engagement, in-scope hostnames/apps/IP ranges, testing window and rules of engagement with points of contact
+4 more
Details: You need

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

/plugin marketplace add AccessITGroup/claude-plugins /plugin install webapp-testing-checklist@AITG-hub
Quoted from README.md#L60-64 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

claude code: permissions.allow: [Read, Grep]; keep Bash, Write and WebFetch on ask, and keep test-credentials.txt and ~/wstg-evidence/ out of synced or shared folders
note: derived from the code, not tested in the lab

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.Markdown JSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit d79e594 on 2026-10-25: 52 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, sends data out, according to the capabilities read.

What it can do, by group
Group	What it covers	Effect	On by default
Backseat mode benign traffic	Sends ordinary application traffic itself, such as viewing pages, following links and submitting forms with non-malicious input, when it helps gather checklist context. SKILL.md L10-13, SKILL.md#L10-13 at the checked commit	reads, sends data out	yes
Repeated-attempt tests	Sends repeated requests such as several failed logins for lockout testing after telling the tester the count and target and getting explicit go-ahead each time. SKILL.md L262-268, SKILL.md#L262-268 at the checked commit	sends data out	no, optional
Evidence directory convention	Keeps raw request/response captures and screenshots in ~/wstg-evidence/, split into fail-evidence/ and pass-evidence/ with one subfolder per WSTG test ID. SKILL.md L100-106, SKILL.md#L100-106 at the checked commit	reads, changes	yes
Self-tested findings	Writes the real requests and responses of the skill's own benign checks, such as fingerprinting, header checks and tester-directed forced-browsing/IDOR checks, to evidence.txt. SKILL.md L140-148, SKILL.md#L140-148 at the checked commit	reads, changes	yes
Account creation (gated)	Creates a test account in the target application only after the tester confirms the SOW allows it and gives a real-time go-ahead for that account. SKILL.md L233-240, SKILL.md#L233-240 at the checked commit	changes	no, optional
Step 4 — Report	Asks for Markdown, Word (.docx) and/or PDF and writes the report with whatever document-generation capability the environment has. SKILL.md L172-176, SKILL.md#L172-176 at the checked commit	changes	yes
Test credentials file	Reads the test accounts once from a plain-text file in the working directory (suggested name test-credentials.txt), then refers to them by label only in the session and report. SKILL.md L44-53, SKILL.md#L44-53 at the checked commit	reads	yes
Step 3 — Walk the checklist	Loads one references/ category file at a time, states each test ID and what it verifies, and takes evidence or a direct Pass/Fail/N/A verdict from the tester. SKILL.md L81-90, SKILL.md#L81-90 at the checked commit	reads	yes
Step 1 — Authorization gate	Before anything else, has the tester confirm written authorization for the target (signed SOW, pentest agreement or equivalent); stops and explains what is missing. SKILL.md L21-26, SKILL.md#L21-26 at the checked commit	guides only: asks, explains or decides, acts on nothing itself	yes
Step 2 — Scope intake	Asks whether the app is server-rendered, API-only or an SPA with a backend API, which decides which of the 12 WSTG categories in references/ apply. SKILL.md L65-74, SKILL.md#L65-74 at the checked commit	guides only: asks, explains or decides, acts on nothing itself	yes

Where it sends data and who can connect to it

One outside connection found in the files read: Target web application.

Target web application your targets, by default. Sends benign requests to the in-scope target, such as fingerprinting, header checks and tester-directed forced-browsing/IDOR checks. SKILL.md L140-142, SKILL.md#L140-142 at the checked commit

Listens for no connections in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

The client's model loads each in-scope WSTG category file from references/ one at a time as the walk reaches it, instead of all 12 up front. SKILL.md L81-82, SKILL.md#L81-82 at the checked commit

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

SKILL.md Skill manifest with frontmatter name webapp-testing-checklist and a description of the WSTG checklist walk, findings report and backseat-mode limits. SKILL.md L1-3, SKILL.md#L1-3 at the checked commit
references/ category tables WSTG checklist tables, one file per category, each row a test ID, title and what it verifies; loaded as the walk reaches the category. 00-overview.md L31-33, references/00-overview.md#L31-33 at the checked commit

Your machine

Programs and files on the machine where you run the tool.

test-credentials.txt Plain-text file in the working directory with one test account per line: label, role, username, password. SKILL.md L43-48, SKILL.md#L43-48 at the checked commit
~/wstg-evidence/ Evidence directory in the home directory, split into fail-evidence/ and pass-evidence/ with folders named by WSTG test ID (e.g. WSTG-AUTHZ-04). SKILL.md L103-106, SKILL.md#L103-106 at the checked commit
Tester's own tooling Burp Suite, ZAP, curl, browser devtools and similar tools the tester uses for the actual security testing. SKILL.md L15-16, SKILL.md#L15-16 at the checked commit

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 3 (privileged), read from the code. Not run in our lab yet.

Privilege Reach: six rights, each read three ways. Levels 0 to 3; ? means no evidence.
Right	Author sayswhat the author says	Code showswhat static analysis finds	Run showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

Files · 2CHANGELOG.md L30-31 the author states that findings from the skill's own traffic are saved under ~/wstg-evidence/ in the home directory
Network · 1README.md L7-9 the author declares only ordinary benign traffic to the application under test, with no payloads or scanners
Execution · 1README.md L88-94 the author names local document converters such as pandoc or python-docx for the Word report
Secrets · 2README.md L33-37 the author declares a plain-text file with test credentials in the working directory
Persistence · 3README.md L39-42 the author declares that the skill may create a test account in the target application once the statement of work allows it and the tester confirms, which is a new user on the target

Code shows: the evidence

Files · 2SKILL.md L146-148 the agent writes the requests and responses it sent into ~/wstg-evidence/ in the home directory, outside the working directory
Network · 1SKILL.md L140-142 the agent itself sends benign requests such as fingerprinting, header checks and forced-browsing checks to the target confirmed at the authorization gate
Execution · 2SKILL.md L174-176 report conversion is left to whatever document tooling the environment offers, with no fixed list of programs
Secrets · 2SKILL.md L43-52 the agent reads a plain-text file with several test accounts and their passwords from the working directory
Persistence · 3SKILL.md L233-240 after the statement of work and a real-time go-ahead the agent may create a user account in the target application, which is a new user on the target and therefore level 3
Approval · ?no evidence: no allowed-tools, settings or auto-mode instructions were found, but the search patterns for approvals match one line in SKILL.md, so a zero cannot be written

Valid for commit d79e594 · checked 2026-10-21 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

The authorization gate is a prompt the model follows and cannot verify anything; it relies on the tester answering honestly. README.md L44-46, README.md#L44-46 at the checked commit
The author notes that a fork can strip the guardrails out entirely. README.md L46-47, README.md#L46-47 at the checked commit
test-credentials.txt holds live secrets in plain text in the working directory; the skill reminds the tester to .gitignore it and delete it after the engagement. SKILL.md L54-56, SKILL.md#L54-56 at the checked commit
~/wstg-evidence/ in the home directory can accumulate captured HTTP traffic, cookies, session tokens and client-identifying data; the skill prompts the tester to delete or archive it after the report. SKILL.md L206-210, SKILL.md#L206-210 at the checked commit
Target page bodies, headers and pasted captures enter the model's context; the skill tells the model to treat instructions inside them as data and not act on them. SKILL.md L214-220, SKILL.md#L214-220 at the checked commit
The guardrail eval cases in evals/ were written against the documented schema and have not been run end to end. README.md L21-23, evals/README.md#L21-23 at the checked commit
Running the eval suite with claude plugin eval requires early access on the account or organization. README.md L20-21, evals/README.md#L20-21 at the checked commit
A clean run is not a certification; WSTG is not exhaustive and the references/ summaries are shorter than the full WSTG guidance. README.md L81-83, README.md#L81-83 at the checked commit
The client's model reads the credentials file itself, so test usernames and passwords enter its context; the skill tells it not to repeat them in the conversation or report. SKILL.md L52-54, SKILL.md#L52-54 at the checked commit
The skill tells the model to decline destructive, high-volume or DoS-style traffic, regardless of what the stated rules of engagement say. SKILL.md L241-246, SKILL.md#L241-246 at the checked commit
The skill tells the model to stop and reconfirm scope before touching a host, port or path that was not confirmed at Step 1. SKILL.md L247-250, SKILL.md#L247-250 at the checked commit
The skill tells the model never to run exploit code, PoC scripts or third-party attack tooling, even when the tester supplies it, and to hand that back to the tester. SKILL.md L257-261, SKILL.md#L257-261 at the checked commit
Not covered: what it does at runtime. Other connections not ruled out: read in the documentation and the cited code, not searched in full.

What you need and what the documented installer does

What you need
Kind	What
AI client	Claude Code
Runtime	Claude Code, with the skill installed from the AITG-hub marketplace or directly. README.md L60, README.md#L60 at the checked commit
Authorisation	Written authorization to test the specific target, such as a signed SOW or pentest agreement. SKILL.md L26-28, SKILL.md#L26-28 at the checked commit
Authorisation	Named engagement, in-scope hostnames/apps/IP ranges, testing window and rules of engagement with points of contact. SKILL.md L29-34, SKILL.md#L29-34 at the checked commit
Credentials	Test accounts in a plain-text file in the working directory, one per line with label, role, username and password. SKILL.md L44-48, SKILL.md#L44-48 at the checked commit
Other tools	The tester's own testing tools, such as Burp Suite, ZAP, curl or browser devtools, for the actual security testing. README.md L10, README.md#L10 at the checked commit
Other tools	For .docx reports with screenshots, the author reports pandoc or python-docx, where available, as more reliable than OS-builtin converters. README.md L93-94, README.md#L93-94 at the checked commit
Other tools	Screenshots of self-tested findings need a visual or browser-automation capability in the environment, not just a CLI HTTP client. SKILL.md L153-155, SKILL.md#L153-155 at the checked commit

What the documented installer does

Adds the AITG-hub marketplace from the GitHub repository AccessITGroup/claude-plugins, then installs webapp-testing-checklist@AITG-hub; the marketplace repository is separate from this one. README.md L62-65, README.md#L62-65 at the checked commit
Versions follow the webapp-testing-checklist entry in the AITG-hub marketplace; CHANGELOG.md lists 0.7.0 as the latest. CHANGELOG.md L3-6, CHANGELOG.md#L3-6 at the checked commit

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Type: Skill · Offensive · works with Claude Code
Source: github.com/AccessITGroup/webapp-testing-checklist · MIT AND CC-BY-SA-4.0 · manifest SKILL.md
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.: d79e594 · last upstream push 2026-09-03 · no release since the pinned commit
In the catalog: listed · added 2026-10-21 · last checked 2026-10-21 · next check 2027-01-19 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.: cisco-skill-scanner: not run, pending
Changes: none since the entry was added on 2026-10-21
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.: v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdown as JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit d79e594, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit d79e594 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (52 of 52), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Webapp Testing Checklist". Agentic Security Field Guide, checked 2026-10-21, method reach-v0.1. https://readbeforerun.ai/catalog/accessitgroup-webapp-testing-checklist/

The method · the rules

For maintainers

Badge for your README (reach 3 · not run yet):

[![reach 3 · not run yet](https://readbeforerun.ai/badge/accessitgroup-webapp-testing-checklist.svg)](https://readbeforerun.ai/catalog/accessitgroup-webapp-testing-checklist/)