สร้าง Security Test อัตโนมัติด้วย owasp/skill

Automate Security Testing with an AI Skill

Bottom Line Up Front: You can build a reusable Claude Code skill to automatically generate OWASP Top 10 security tests using PlaySpec and FakeRequest. This ensures consistent security testing across your Play Framework controllers.

Writing security tests is tedious, repetitive, and easy to skip when a deadline is close. But it is also exactly the kind of work an AI assistant is good at — well-defined patterns, repeated across many endpoints. Instead of asking Claude the same thing every time, you can capture that knowledge once as a skill and reuse it forever.

This post walks through a custom Claude Code skill that turns any Play Framework controller into a full OWASP Top 10 security test suite using PlaySpec and FakeRequest.

What is a Skill?

A skill is a reusable instruction set you give to an AI agent. It is a Markdown file with a small frontmatter header and a body of instructions. When you invoke it, the agent loads those instructions as expert context — so it behaves like a specialist instead of a generalist.

The frontmatter has three useful fields:

• name — the identifier you invoke the skill by.
• description — a one-line summary the agent uses to decide when the skill is relevant.
• argument-hint — tells the user what input to provide (here, a controller or route).

The Skill Definition

Here is the full skill. It tells the agent to act as a security-focused SDET and produce integration tests against the OWASP Top 10 — not generic unit tests.

---
name: owasp-playspec-tester
description: "Generates Scala Play Framework security tests using
  PlaySpec and FakeRequest based on OWASP Top 10 vulnerabilities."
argument-hint: "Specify the target Play controller or endpoint route
  to generate tests for."
---

# OWASP Play Framework Security Tester

You are an expert Security Software Development Engineer in Test (SDET).
Your task is to generate automated security integration tests for Play
Framework applications using PlaySpec, FakeRequest, and ScalaTest.

## Instructions
When the user provides a controller, model, or route, generate a
PlaySpec test class that verifies the application's resilience against
OWASP Top 10 2025 vulnerabilities.

The Test Coverage It Enforces

The heart of the skill is a checklist of attack classes. Every generated suite must cover all four, so nothing gets quietly skipped:

• Injection (SQL/NoSQL/Command) — sends payloads like ' OR 1=1 -- and asserts the response is 400 BAD_REQUEST or 401 UNAUTHORIZED, never a leaky 500 INTERNAL_SERVER_ERROR.
• Cross-Site Scripting (XSS) — injects <script>alert(1)</script> into JSON or form bodies and asserts the raw payload is not reflected back unescaped.
• Security Misconfiguration — checks that responses carry secure headers (X-Frame-Options, X-Content-Type-Options, Content-Security-Policy).
• Broken Access Control — hits restricted endpoints with no valid session or JWT and asserts 401 UNAUTHORIZED or 403 FORBIDDEN.

Code Guidelines

The skill also pins down how the tests are written, so the output is consistent and runnable:

• Seed test data in a def initial(): Unit to simulate records in the database.
• Use play.api.test.FakeRequest to simulate malicious traffic.
• Use play.api.test.Helpers._ for routing and assertions (status(result), contentAsString(result)).
• Produce valid Scala in ScalaTest BDD style: "Endpoint" should { "reject..." in { ... } }.

What the Output Looks Like

Point the skill at a controller and it produces a ready-to-run spec. A trimmed example:

class UserControllerSecuritySpec extends PlaySpec with GuiceOneAppPerSuite {

  def initial(): Unit = {
    // seed a known user to attack against
  }

  "UserController" should {

    "reject SQL injection in the login field" in {
      val payload = Json.obj("username" -> "' OR 1=1 --", "password" -> "x")
      val request = FakeRequest(POST, "/login").withJsonBody(payload)
      val result  = route(app, request).get

      status(result) must (be(BAD_REQUEST) or be(UNAUTHORIZED))
      status(result) mustNot be(INTERNAL_SERVER_ERROR)
    }

    "escape XSS payloads in the profile name" in {
      val payload = Json.obj("name" -> "<script>alert(1)</script>")
      val request = FakeRequest(POST, "/profile").withJsonBody(payload)
      val result  = route(app, request).get

      contentAsString(result) mustNot include("<script>")
    }

    "return secure headers on the home page" in {
      val result = route(app, FakeRequest(GET, "/")).get

      header("X-Frame-Options", result) mustBe defined
      header("X-Content-Type-Options", result) mustBe defined
      header("Content-Security-Policy", result) mustBe defined
    }

    "block access to admin without a token" in {
      val result = route(app, FakeRequest(GET, "/admin")).get

      status(result) must (be(UNAUTHORIZED) or be(FORBIDDEN))
    }
  }
}

Why Capture It as a Skill

• ✅ Consistency — every endpoint gets the same four attack classes, every time.
• ✅ Speed — no re-explaining the requirements on each new controller.
• ✅ Shared standard — the whole team invokes the same security baseline.
• ✅ Living documentation — the skill file is your security testing policy.

Bottom Line

Security testing does not have to be the task everyone avoids. By encoding the OWASP Top 10 into a small, reusable skill, you turn a chore into a one-line command — and make "did we test for injection?" a question with a reliable answer.

Generated tests are a starting point, not a guarantee. Always review them and pair with manual security review for high-risk endpoints.

---
name: owasp-playspec-tester
description: "Generates Scala Play Framework security tests using
  PlaySpec and FakeRequest based on OWASP Top 10 vulnerabilities."
argument-hint: "Specify the target Play controller or endpoint route
  to generate tests for."
---

# OWASP Play Framework Security Tester

You are an expert Security Software Development Engineer in Test (SDET).
Your task is to generate automated security integration tests for Play
Framework applications using PlaySpec, FakeRequest, and ScalaTest.

## Instructions
When the user provides a controller, model, or route, generate a
PlaySpec test class that verifies the application's resilience against
OWASP Top 10 2025 vulnerabilities.

class UserControllerSecuritySpec extends PlaySpec with GuiceOneAppPerSuite {

  def initial(): Unit = {
    // seed a known user to attack against
  }

  "UserController" should {

    "reject SQL injection in the login field" in {
      val payload = Json.obj("username" -> "' OR 1=1 --", "password" -> "x")
      val request = FakeRequest(POST, "/login").withJsonBody(payload)
      val result  = route(app, request).get

      status(result) must (be(BAD_REQUEST) or be(UNAUTHORIZED))
      status(result) mustNot be(INTERNAL_SERVER_ERROR)
    }

    "escape XSS payloads in the profile name" in {
      val payload = Json.obj("name" -> "<script>alert(1)</script>")
      val request = FakeRequest(POST, "/profile").withJsonBody(payload)
      val result  = route(app, request).get

      contentAsString(result) mustNot include("<script>")
    }

    "return secure headers on the home page" in {
      val result = route(app, FakeRequest(GET, "/")).get

      header("X-Frame-Options", result) mustBe defined
      header("X-Content-Type-Options", result) mustBe defined
      header("Content-Security-Policy", result) mustBe defined
    }

    "block access to admin without a token" in {
      val result = route(app, FakeRequest(GET, "/admin")).get

      status(result) must (be(UNAUTHORIZED) or be(FORBIDDEN))
    }
  }
}

---
name: owasp-playspec-tester
description: "Generates Scala Play Framework security tests using
  PlaySpec and FakeRequest based on OWASP Top 10 vulnerabilities."
argument-hint: "Specify the target Play controller or endpoint route
  to generate tests for."
---

# OWASP Play Framework Security Tester

You are an expert Security Software Development Engineer in Test (SDET).
Your task is to generate automated security integration tests for Play
Framework applications using PlaySpec, FakeRequest, and ScalaTest.

## Instructions
When the user provides a controller, model, or route, generate a
PlaySpec test class that verifies the application's resilience against
OWASP Top 10 2025 vulnerabilities.

class UserControllerSecuritySpec extends PlaySpec with GuiceOneAppPerSuite {

  def initial(): Unit = {
    // seed a known user to attack against
  }

  "UserController" should {

    "reject SQL injection in the login field" in {
      val payload = Json.obj("username" -> "' OR 1=1 --", "password" -> "x")
      val request = FakeRequest(POST, "/login").withJsonBody(payload)
      val result  = route(app, request).get

      status(result) must (be(BAD_REQUEST) or be(UNAUTHORIZED))
      status(result) mustNot be(INTERNAL_SERVER_ERROR)
    }

    "escape XSS payloads in the profile name" in {
      val payload = Json.obj("name" -> "<script>alert(1)</script>")
      val request = FakeRequest(POST, "/profile").withJsonBody(payload)
      val result  = route(app, request).get

      contentAsString(result) mustNot include("<script>")
    }

    "return secure headers on the home page" in {
      val result = route(app, FakeRequest(GET, "/")).get

      header("X-Frame-Options", result) mustBe defined
      header("X-Content-Type-Options", result) mustBe defined
      header("Content-Security-Policy", result) mustBe defined
    }

    "block access to admin without a token" in {
      val result = route(app, FakeRequest(GET, "/admin")).get

      status(result) must (be(UNAUTHORIZED) or be(FORBIDDEN))
    }
  }
}

---
name: owasp-playspec-tester
description: "Generates Scala Play Framework security tests using
  PlaySpec and FakeRequest based on OWASP Top 10 vulnerabilities."
argument-hint: "Specify the target Play controller or endpoint route
  to generate tests for."
---

# OWASP Play Framework Security Tester

You are an expert Security Software Development Engineer in Test (SDET).
Your task is to generate automated security integration tests for Play
Framework applications using PlaySpec, FakeRequest, and ScalaTest.

## Instructions
When the user provides a controller, model, or route, generate a
PlaySpec test class that verifies the application's resilience against
OWASP Top 10 2025 vulnerabilities.

class UserControllerSecuritySpec extends PlaySpec with GuiceOneAppPerSuite {

  def initial(): Unit = {
    // seed a known user to attack against
  }

  "UserController" should {

    "reject SQL injection in the login field" in {
      val payload = Json.obj("username" -> "' OR 1=1 --", "password" -> "x")
      val request = FakeRequest(POST, "/login").withJsonBody(payload)
      val result  = route(app, request).get

      status(result) must (be(BAD_REQUEST) or be(UNAUTHORIZED))
      status(result) mustNot be(INTERNAL_SERVER_ERROR)
    }

    "escape XSS payloads in the profile name" in {
      val payload = Json.obj("name" -> "<script>alert(1)</script>")
      val request = FakeRequest(POST, "/profile").withJsonBody(payload)
      val result  = route(app, request).get

      contentAsString(result) mustNot include("<script>")
    }

    "return secure headers on the home page" in {
      val result = route(app, FakeRequest(GET, "/")).get

      header("X-Frame-Options", result) mustBe defined
      header("X-Content-Type-Options", result) mustBe defined
      header("Content-Security-Policy", result) mustBe defined
    }

    "block access to admin without a token" in {
      val result = route(app, FakeRequest(GET, "/admin")).get

      status(result) must (be(UNAUTHORIZED) or be(FORBIDDEN))
    }
  }
}

---
name: owasp-playspec-tester
description: "Generates Scala Play Framework security tests using
  PlaySpec and FakeRequest based on OWASP Top 10 vulnerabilities."
argument-hint: "Specify the target Play controller or endpoint route
  to generate tests for."
---

# OWASP Play Framework Security Tester

You are an expert Security Software Development Engineer in Test (SDET).
Your task is to generate automated security integration tests for Play
Framework applications using PlaySpec, FakeRequest, and ScalaTest.

## Instructions
When the user provides a controller, model, or route, generate a
PlaySpec test class that verifies the application's resilience against
OWASP Top 10 2025 vulnerabilities.

class UserControllerSecuritySpec extends PlaySpec with GuiceOneAppPerSuite {

  def initial(): Unit = {
    // seed a known user to attack against
  }

  "UserController" should {

    "reject SQL injection in the login field" in {
      val payload = Json.obj("username" -> "' OR 1=1 --", "password" -> "x")
      val request = FakeRequest(POST, "/login").withJsonBody(payload)
      val result  = route(app, request).get

      status(result) must (be(BAD_REQUEST) or be(UNAUTHORIZED))
      status(result) mustNot be(INTERNAL_SERVER_ERROR)
    }

    "escape XSS payloads in the profile name" in {
      val payload = Json.obj("name" -> "<script>alert(1)</script>")
      val request = FakeRequest(POST, "/profile").withJsonBody(payload)
      val result  = route(app, request).get

      contentAsString(result) mustNot include("<script>")
    }

    "return secure headers on the home page" in {
      val result = route(app, FakeRequest(GET, "/")).get

      header("X-Frame-Options", result) mustBe defined
      header("X-Content-Type-Options", result) mustBe defined
      header("Content-Security-Policy", result) mustBe defined
    }

    "block access to admin without a token" in {
      val result = route(app, FakeRequest(GET, "/admin")).get

      status(result) must (be(UNAUTHORIZED) or be(FORBIDDEN))
    }
  }
}