CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/attack-surface-test-checklist

Maps a code change to the security tests worth running against it. Classifies changed paths and file contents into nine attack surfaces (authentication, session management, input handling, file upload, deserialization, access control, API and web service, cryptography, data protection), attaches the matching OWASP ASVS 4.0.3 verification requirements, OWASP Top 10 2021 category IDs, and OWASP WSTG section numbers to each active surface, then emits a per-surface manual and automated test checklist bounded by what actually changed. Surfaces with no changed lines are excluded rather than carried as filler. Use when a pull request, release branch, or feature is about to be security tested and the team needs a targeted test list instead of a generic application-wide checklist.

68

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable security-testing skill with a clear sequenced workflow and concrete standards-backed items. Its main weaknesses are conciseness (inline catalog duplication and time-sensitive version detail) and progressive disclosure (large tables and one full surface's items live in SKILL.md alongside the reference bundle).

Suggestions

Move the full nine-surface ASVS table and Top 10/WSTG table into references/per-surface-test-items.md (or a dedicated reference file), keeping only the classification table and a pointer in SKILL.md to remove the inline duplication.

Relocate the ASVS 5.0.0 release-date and version-migration discussion into a clearly marked 'Version notes' or 'Deprecated/old patterns' section so the time-sensitive material does not penalize the lean overview.

Inline only the Authentication surface as a representative example and defer all nine surfaces' Manual/Automated items to the reference, since the body already states the remaining eight follow the same shape.

DimensionReasoningScore

Conciseness

Mostly efficient and assumes Claude's intelligence (no OWASP primers), but reproduces the full nine-surface ASVS and Top 10/WSTG tables inline despite a references/per-surface-test-items.md bundle existing, and includes time-sensitive detail (the ASVS 5.0.0 release date) outside any deprecated/old-patterns section — matching the score-2 anchor of mostly efficient with some unnecessary content rather than the lean score-3.

2 / 3

Actionability

Gives concrete, executable guidance: named path/content signals, specific ASVS requirement IDs (2.4.1, 5.3.4, 12.6.1), named WSTG sections, and runnable per-item instructions like 'Fetch another tenant's document id with a valid token' and 'Run static-analysis rules for plaintext or reversibly-stored credentials against the changed files only', plus a copy-paste-ready worked example — matching the score-3 anchor for an instruction-only skill.

3 / 3

Workflow Clarity

Clear four-step sequence (mark surfaces, attach ASVS, tag Top 10/WSTG, emit items) with explicit classification checkpoints ('Path first, content second', 'a surface with zero changed lines is excluded') and a 7-item ordered output format with a mandatory disclaimer, matching the score-3 anchor of a clear sequence with explicit checkpoints.

3 / 3

Progressive Disclosure

Has a well-signaled one-level-deep reference ('Pull the full catalog from references/per-surface-test-items.md', and the file exists), but much catalog content (both standards tables and the full Authentication item set) is duplicated inline rather than split out, matching the score-2 anchor where content that should be separate is inline rather than the cleanly-split score-3.

2 / 3

Total

10

/

12

Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, third-person description that clearly states what it does and when to use it, with a distinct niche and explicit trigger guidance. Its only weakness is trigger-term naturalness: it over-indexes on catalog jargon and could add the plain phrasings a user would actually say.

Suggestions

Add one or two natural-language triggers a user would actually say (e.g., 'security test this pull request', 'what security tests should I run on this change') alongside the OWASP catalog terms.

Consider trimming the catalog jargon in the description (e.g., the bare list of all nine surfaces) since the body covers it; keep the description focused on the trigger and the bounded-checklist differentiator.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Classifies changed paths and file contents into nine attack surfaces', 'attaches the matching OWASP ASVS 4.0.3 verification requirements', 'emits a per-surface manual and automated test checklist bounded by what actually changed' — matching the score-3 anchor of multiple specific concrete actions rather than the partial score-2.

3 / 3

Completeness

Explicitly answers both what (maps a change to tests via classify/attach/tag/emit) and when ('Use when a pull request, release branch, or feature is about to be security tested'), matching the score-3 anchor with an explicit 'Use when' clause rather than the score-2 where the when is only implied.

3 / 3

Trigger Term Quality

Includes relevant triggers ('pull request, release branch, or feature is about to be security tested', 'the team needs a targeted test list') but leans heavily on catalog jargon (ASVS 4.0.3, WSTG section numbers) and omits common natural phrasings like 'security test my PR' or 'what should I test in this change', matching the score-2 anchor of some relevant keywords but missing common variations.

2 / 3

Distinctiveness Conflict Risk

Occupies a clear niche — a per-change OWASP/ASVS/WSTG test checklist bounded by changed surfaces — with triggers distinct from generic scanners, pentest methodology, or compliance audits, matching the score-3 anchor of a clear niche unlikely to conflict.

3 / 3

Total

11

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents

DiscoveryImplementationValidation