OWASP/wstg ? reverse-engineered prompt