---

name: security-test-suite description: | Comprehensive security testing framework aligned with OWASP Top 10 and CWE/SANS Top 25. Performs static analysis (SAST), dependency auditing (SCA), secret scanning, and infrastructure security checks. Generates actionable remediation reports with CVSS severity scoring. license: MIT allowed-tools:

• Bash
• Read
• Write
• Edit
• Glob
• Grep compatibility: claude-code: ">=1.0.0" metadata: version: "1.0.0" author: "QuantQuiver AI R&D" category: "testing" tags:
  • security
  • owasp
  • sast
  • vulnerability-scanning
  • secret-detection

---

Security Test Suite

Purpose

Comprehensive security testing framework aligned with OWASP Top 10 and CWE/SANS Top 25. Performs static analysis (SAST), dependency auditing (SCA), secret scanning, and infrastructure security checks. Generates actionable remediation reports.

Triggers

Use this skill when:

• "security scan"
• "check for vulnerabilities"
• "OWASP compliance test"
• "penetration test preparation"
• "security audit"
• "find security issues"
• "dependency vulnerability check"

When to Use

• Pre-deployment security review
• Compliance requirements (SOC2, HIPAA, PCI-DSS)
• New third-party integrations
• Authentication/authorization changes
• Handling sensitive data
• Public-facing applications

When NOT to Use

• Functional testing (use unit-test-generator)
• Performance testing (use performance-benchmark)
• Data quality validation (use data-validation)

---

Core Instructions

Security Testing Layers

OWASP Top 10 Coverage

Severity Scoring (CVSS 3.1)

Detection Patterns

Copypatterns:
  sql_injection:
    regex: '\.execute\s*\(\s*f["\']'
    severity: CRITICAL
    cwe: CWE-89
    message: "F-strings in SQL queries lead to injection"

  hardcoded_secret:
    regex: '(password|secret|api_key)\s*=\s*["\'][^"\']+["\']'
    severity: HIGH
    cwe: CWE-798
    message: "Hardcoded credentials detected"

  eval_usage:
    regex: 'eval\s*\([^)]*\)'
    severity: HIGH
    cwe: CWE-95
    message: "eval() can execute arbitrary code"

---

Templates

Security Report

Copy# Security Scan Report

**Timestamp:** {timestamp}
**Repository:** {repository}

## Executive Summary

**Overall Risk Level:** {risk_level}

| Severity | Count | SLA |
| -------- | ----- | --- |
| Critical | {critical} | 24 hours |
| High | {high} | 7 days |
| Medium | {medium} | 30 days |
| Low | {low} | 90 days |

## Critical Findings

### {finding_id}: {title}

**Severity:** {severity} (CVSS: {cvss})
**CWE:** {cwe_id}
**Location:** `{file_path}:{line_number}`

**Code:**

{code_snippet}

Copy
**Remediation:**
{remediation}

---

Example

Input: Security scan of Flask application

Output:

Copy## Executive Summary

**Overall Risk Level:** HIGH

| Severity | Count |
| -------- | ----- |
| Critical | 1 |
| High | 3 |
| Medium | 5 |

## Critical Findings

### SAST-0001: SQL injection via f-string

**Severity:** CRITICAL (CVSS: 9.5)
**Location:** `app/database.py:45`

**Code:**

```python
query = f"SELECT * FROM users WHERE id = {user_id}"
cursor.execute(query)

Remediation: Use parameterized queries:

Copycursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

Copy
---

## Validation Checklist

- [ ] All source files scanned
- [ ] Dependency manifests analyzed
- [ ] Git history checked for secrets (if enabled)
- [ ] All CRITICAL issues have specific remediation
- [ ] OWASP coverage mapping complete
- [ ] False positives reviewed and documented

---

## Related Skills

- `api-contract-validator` - For API security testing
- `unit-test-generator` - For testing security fixes
- `test-health-monitor` - For security test coverage