top-web-vulnerabilities
Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.
Profile →npx skills add sickn33/agentic-awesome-skills --skill top-web-vulnerabilities --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Provides a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category to support vulnerability identification, impact assessment, and remediation guidance.
How it works
Follows a core workflow across multiple phases (Injection Vulnerabilities, Authentication and Session Security, Sensitive Data Exposure, Security Misconfiguration, XML-Related Vulnerabilities, Broken Access Control, Insecure Deserialization, API Security Assessment, Communication Security, Client-Side Vulnerabilities) to define each vulnerability with its definition, root cause, impact, and mitigation. The catalog includes specific entries such as SQL Injection (1), Cross-Site Scripting - XSS (2), Command Injection (5, 11), and many others with phase-specific context and mitigation guidance.
When to use it
Use when performing structured vulnerability identification, risk assessment, and remediation planning for web applications. Applicable in educational or authorized security assessment contexts as indicated by the authorization notes and risk designation.
What it can touch
Tools declared for use include: claude-code, codex, cursor.
Caveats
Contains explicit authorization gating for probing or exploiting actions, requiring target URL/IP and written authorization before any commands are executed. The skill is labeled as offensive risk and is sourced as community rather than official security guidance. No outcomes are promised beyond the defined mitigations and definitions per entry. License indicated: MIT.
> **⚠️ AUTHORIZED USE ONLY** > This skill is for educational purposes or authorized security assessments only. > You must have explicit, written permission from the system owner before using this tool. > Misuse of this tool is illegal and strictly prohibited. > **Mandatory confirmation gate** > Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: > 1. Ask the user to state the exact target URL, IP, account, or resource. > 2. Ask the user to confirm written authorization and the permitted scope. > 3. Show the exact command(s) and explain their expected effect. > 4. Wait for explicit confirmation in the current conversation. > > Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. # Top 100 Web Vulnerabilities Reference ## Purpose Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats. Content organ
- Purpose
- Prerequisites
- Outputs and Deliverables
- Core Workflow
- Phase 1: Injection Vulnerabilities Assessment
- Phase 2: Authentication and Session Security
- Phase 3: Sensitive Data Exposure
- Phase 4: Security Misconfiguration
- Phase 5: XML-Related Vulnerabilities
- Phase 6: Broken Access Control
- Phase 7: Insecure Deserialization
- Phase 8: API Security Assessment
- Phase 9: Communication Security
- Phase 10: Client-Side Vulnerabilities
What does the top-web-vulnerabilities skill do?
Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill top-web-vulnerabilities --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.