Web App Scanner

What it does

When your agent uses it

• Reviewing deploy secrets
• Frontend build artifacts and source maps
• Static XSS sinks
• An authorized live web estate

Example prompts

• “/web-app-scanner”

Requirements

• Python 3
• Pre-approved tools (allowed-tools): Read, Write, Edit, Glob, Grep, Bash

Workflow steps

7 steps, taken from the step headings in SKILL.md.

1. 1Authorization & Routing
2. 2Environment check
3. 3Subdomain enumeration (map the estate)
4. 4Passive recon (no install)
5. 5Active vulnerability checks (non-destructive, authorized only)
6. 6SQL injection testing (guarded, authorized only)
7. 7Report & remediate

What it can do on your machine

Read from SKILL.md and the folder at commit ce2b65e. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Write
  • Edit
  • Glob
  • Grep
  • Bash

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 2 files in scripts/ (Python, from the files we listed), which the agent can run.

  Shell commands in SKILL.md call:

  • python
  • pip

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Web App Scanner loads about 3.2k tokens when it runs, and up to ~5.3k if it reads all its reference files. Until then it costs about 94 tokens; SKILL.md has 1,278 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~94

When it runs · the whole SKILL.md, loaded when a task matches

~3.2k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~5.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:67

  - Deploy `.env*` values for empty/default/example secrets, values shorter than 32 characters, repeating or sequential pa

• NoteMentions a .env fileSKILL.md:143

  or real app-layer bugs — exposed `.git`/`.env`/backups & `security.txt`, reflected XSS, open redirect, path traversal (L

• NoteMentions a .env fileSKILL.md:193

  - **Exposed `.git`/`.env`/backups** → remove from web root; rotate any leaked secrets; block dotfiles at the web server.

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Read, Write, Edit, Glob, Grep, Bash

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 1,278 words (~3,207 tokens).

name

web-app-scanner

allowed-tools

Read, Write, Edit, Glob, Grep, Bash

Read the full SKILL.md on GitHub

Files

SKILL.md and 22 other files (scripts, references) in web-app-scanner of ptn1411/skill.

• SKILL.md
• python-library/README.md
• python-library/__init__.py
• python-library/__main__.py
• python-library/api_contract.py
• python-library/apk_inspector.py
• python-library/bundle_analyzer.py
• python-library/cli.py
• python-library/index.json
• python-library/port_scanner.py
• python-library/security_headers.py
• python-library/sourcemap_extractor.py
• python-library/string_extractor.py
• python-library/web_audit.py
• references/brain_python_library.md
• references/web_checklist.md
• scripts/brain_python_library.py
• scripts/deploy_audit.py
• … and 5 more

Open the folder on GitHubat commit ce2b65e