owasp-guide-research

owasp-guide-research

Use this skill whenever a question depends on the content of the OWASP Web Security Testing Guide (WSTG), Mobile Application Security Testing Guide (MASTG), IoT Security Testing Guide (ISTG), or AI Testing Guide (AITG) as compiled into the pentest-guide-kb MCP server.

This server is read-only knowledge retrieval. It cannot run a scan, execute a command, fetch an arbitrary URL, sync sources, or run ingestion. Nothing it returns has been executed against a real target.

Mandatory behavior

1. Query the MCP whenever an answer depends on OWASP testing-guide content. Do not answer from training-data memory of these guides -- the compiled registry may differ from what you remember (different version, updated content, or a test that doesn't exist).
2. Resolve exact test identifiers before semantic search. If the user gives or you can infer a test id (WSTG-ATHN-01, WSTG-v42-ATHN-01, MASTG-TEST-0326, ...), call guide_get_test directly rather than guide_search.
3. Always report the guide version. Every result carries guide.name + guide.version (or guide_version on a TestCase) -- include it in your answer, not just the test id.
4. Distinguish official content from deterministic, manual, and llm_inferred relationships. Every relationship has provenance.source_type. Never present an llm_inferred edge as official OWASP guidance -- say explicitly that it's an unreviewed, AI-suggested connection.
5. Cite the test id, guide version, source path, and source commit for any claim you attribute to a guide. These are in source.path / source.commit / source.repository on every result.
6. Never invent test identifiers. If guide_search or guide_get_test returns nothing/not-found, say so -- do not guess a plausible-looking id.
7. Use graph/relationship traversal (guide_get_related_tests, guide_explain_relationship) only when the question actually requires relationships between tests; don't traverse just because it's available.
8. Read the complete test entry (include_full_content=true) before describing its procedure. Don't summarize a test from its title alone.
9. Candidate test recommendations (guide_recommend_candidates) must always be reported together with each candidate's applicability_requirements and the tool's uncertainty disclaimer.
10. Report missing, ambiguous, deprecated, or conflicting information as such. If guide_validate_reference shows a hash mismatch or a missing version, surface that rather than silently using stale data.
11. Do not claim that a candidate test has been executed. Nothing in this server executes tests -- guide_recommend_candidates produces candidates for a human/agent to plan and run elsewhere.
12. Do not convert absence of search results into a security conclusion. "No matching test found in this compiled registry" is not the same as "this system has no such vulnerability" or "OWASP has no guidance on this topic" -- the registry only covers what's been ingested (see pentest-guide://catalog for what's currently compiled).