owasp-security

Name: owasp-security
Author: agamm

300stars26forks

How to install owasp-security?

agamm/claude-code-owasp/owasp-security

$npx -y skills add agamm/claude-code-owasp --skill owasp-security

Installs into the current project.

Summary

Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security. Covers OWASP Top 10:2025, ASVS 5.0, LLM Top 10 (2025), and Agentic AI security (2026).

Files · 1

View on GitHub

SKILL.md

1	# OWASP Security Best Practices Skill
2
3	Apply these security standards when writing or reviewing code.
4
5	Reference files (load on demand):
6	- [`reference/languages.md`](reference/languages.md) — per-language security quirks with unsafe/safe examples for 20+ languages.
7	- [`reference/owasp-report.md`](reference/owasp-report.md) — comprehensive deep-dive on every OWASP 2025–2026 standard.
8
9	## Quick Reference: OWASP Top 10:2025
10
11	\| # \| Vulnerability \| Key Prevention \|
12	\|---\|---------------\|----------------\|
13	\| A01 \| Broken Access Control \| Deny by default, enforce server-side, verify ownership \|
14	\| A02 \| Security Misconfiguration \| Harden configs, disable defaults, minimize features \|
15	\| A03 \| Software Supply Chain Failures \| Lock versions, verify integrity, audit dependencies \|
16	\| A04 \| Cryptographic Failures \| TLS 1.2+, AES-256-GCM, Argon2/bcrypt for passwords \|
17	\| A05 \| Injection \| Parameterized queries, input validation, safe APIs \|
18	\| A06 \| Insecure Design \| Threat model, rate limit, design security controls \|
19	\| A07 \| Authentication Failures \| MFA, check breached passwords, secure sessions \|
20	\| A08 \| Software or Data Integrity Failures \| Sign packages, SRI for CDN, safe serialization \|
21	\| A09 \| Security Logging and Alerting Failures \| Log security events, structured format, alerting \|
22	\| A10 \| Mishandling of Exceptional Conditions \| Fail-closed, hide internals, log with context \|
23
24	## Security Code Review Checklist
25
26	When reviewing code, check for these issues:
27
28	### Input Handling
29	- [ ] All user input validated server-side
30	- [ ] Using parameterized queries (not string concatenation)
31	- [ ] Input length limits enforced
32	- [ ] Allowlist validation preferred over denylist
33
34	### Authentication & Sessions
35	- [ ] Passwords hashed with Argon2/bcrypt (not MD5/SHA1)
36	- [ ] Session tokens have sufficient entropy (128+ bits)
37	- [ ] Sessions invalidated on logout
38	- [ ] MFA available for sensitive operations
39
40	### Access Control
41	- [ ] Check for framework-level auth middleware (e.g., Next.js middleware.ts, proxy.ts, Express middleware) before flagging missing per-route auth
42	- [ ] Authorization checked on every request
43	- [ ] Using object references user cannot manipulate
44	- [ ] Deny by default policy
45	- [ ] Privilege escalation paths reviewed
46
47	### Data Protection
48	- [ ] Sensitive data encrypted at rest
49	- [ ] TLS for all data in transit
50	- [ ] No sensitive data in URLs/logs
51	- [ ] Secrets in environment/vault (not code)
52
53	### Error Handling
54	- [ ] No stack traces exposed to users
55	- [ ] Fail-closed on errors (deny, not allow)
56	- [ ] All exceptions logged with context
57	- [ ] Consistent error responses (no enumeration)
58
59	## Secure Code Patterns
60
61	### SQL Injection Prevention
62	```python
63	# UNSAFE
64	cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
65
66	# SAFE
67	cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
68	```
69
70	### Command Injection Prevention
71	```python
72	# UNSAFE
73	os.system(f"convert {filename} output.png")
74
75	# SAFE
76	subprocess.run(["convert", filename, "output.png"], shell=False)
77	```
78
79	### Password Storage
80	```python
81	# UNSAFE
82	hashlib.md5(password.encode()).hexdigest()
83
84	# SAFE
85	from argon2 import PasswordHasher
86	PasswordHasher().hash(password)
87	```
88
89	### Access Control
90	```python
91	# UNSAFE - No authorization check
92	@app.route('/api/user/<user_id>')
93	def get_user(user_id):
94	return db.get_user(user_id)
95
96	# SAFE - Authorization enforced
97	@app.route('/api/user/<user_id>')
98	@login_required
99	def get_user(user_id):
100	if current_user.id != user_id and not current_user.is_admin:
101	abort(403)
102	return db.get_user(user_id)
103	```
104
105	### Error Handling
106	```python
107	# UNSAFE - Exposes internals
108	@app.errorhandler(Exception)
109	def handle_error(e):
110	return str(e), 500
111
112	# SAFE - Fail-closed, log context
113	@app.errorhandler(Exception)
114	def handle_error(e):
115	error_id = uuid.uuid4()
116	logger.exception(f"Error {error_id}: {e}")
117	return {"error": "An error occurred", "id": str(error_id)}, 500
118	```
119
120	### Fail-Closed Pattern
121	```python
122	# UNSAFE - Fail-open
123	def check_permission(user, resource):
124	try:
125	return auth_service.check(user, resource)
126	except Exception:
127	return True # DANGEROUS!
128
129	# SAFE - Fail-closed
130	def check_permission(user, resource):
131	try:
132	return auth_service.check(user, resource)
133	except Exception as e:
134	logger.error(f"Auth check failed: {e}")
135	return False # Deny on error
136	```
137
138	## Agentic AI Security (OWASP 2026)
139
140	When building or reviewing AI agent systems, check for:
141
142	\| Risk \| Description \| Mitigation \|
143	\|------\|-------------\|------------\|
144	\| ASI01: Agent Goal Hijacking \| Prompt injection alters agent objectives \| Input sanitization, goal boundaries, behavioral monitoring \|
145	\| ASI02: Tool Misuse \| T

People who liked this also viewed

6 picks

Type

owasp-security

300stars26forks

View on GitHub

How to install owasp-security?

agamm/claude-code-owasp/owasp-security

$npx -y skills add agamm/claude-code-owasp --skill owasp-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# OWASP Security Best Practices Skill
2
3	Apply these security standards when writing or reviewing code.
4
5	Reference files (load on demand):
6	- [`reference/languages.md`](reference/languages.md) — per-language security quirks with unsafe/safe examples for 20+ languages.
7	- [`reference/owasp-report.md`](reference/owasp-report.md) — comprehensive deep-dive on every OWASP 2025–2026 standard.
8
9	## Quick Reference: OWASP Top 10:2025
10
11	\| # \| Vulnerability \| Key Prevention \|
12	\|---\|---------------\|----------------\|
13	\| A01 \| Broken Access Control \| Deny by default, enforce server-side, verify ownership \|
14	\| A02 \| Security Misconfiguration \| Harden configs, disable defaults, minimize features \|
15	\| A03 \| Software Supply Chain Failures \| Lock versions, verify integrity, audit dependencies \|
16	\| A04 \| Cryptographic Failures \| TLS 1.2+, AES-256-GCM, Argon2/bcrypt for passwords \|
17	\| A05 \| Injection \| Parameterized queries, input validation, safe APIs \|
18	\| A06 \| Insecure Design \| Threat model, rate limit, design security controls \|
19	\| A07 \| Authentication Failures \| MFA, check breached passwords, secure sessions \|
20	\| A08 \| Software or Data Integrity Failures \| Sign packages, SRI for CDN, safe serialization \|
21	\| A09 \| Security Logging and Alerting Failures \| Log security events, structured format, alerting \|
22	\| A10 \| Mishandling of Exceptional Conditions \| Fail-closed, hide internals, log with context \|
23
24	## Security Code Review Checklist
25
26	When reviewing code, check for these issues:
27
28	### Input Handling
29	- [ ] All user input validated server-side
30	- [ ] Using parameterized queries (not string concatenation)
31	- [ ] Input length limits enforced
32	- [ ] Allowlist validation preferred over denylist
33
34	### Authentication & Sessions
35	- [ ] Passwords hashed with Argon2/bcrypt (not MD5/SHA1)
36	- [ ] Session tokens have sufficient entropy (128+ bits)
37	- [ ] Sessions invalidated on logout
38	- [ ] MFA available for sensitive operations
39
40	### Access Control
41	- [ ] Check for framework-level auth middleware (e.g., Next.js middleware.ts, proxy.ts, Express middleware) before flagging missing per-route auth
42	- [ ] Authorization checked on every request
43	- [ ] Using object references user cannot manipulate
44	- [ ] Deny by default policy
45	- [ ] Privilege escalation paths reviewed
46
47	### Data Protection
48	- [ ] Sensitive data encrypted at rest
49	- [ ] TLS for all data in transit
50	- [ ] No sensitive data in URLs/logs
51	- [ ] Secrets in environment/vault (not code)
52
53	### Error Handling
54	- [ ] No stack traces exposed to users
55	- [ ] Fail-closed on errors (deny, not allow)
56	- [ ] All exceptions logged with context
57	- [ ] Consistent error responses (no enumeration)
58
59	## Secure Code Patterns
60
61	### SQL Injection Prevention
62	```python
63	# UNSAFE
64	cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
65
66	# SAFE
67	cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
68	```
69
70	### Command Injection Prevention
71	```python
72	# UNSAFE
73	os.system(f"convert {filename} output.png")
74
75	# SAFE
76	subprocess.run(["convert", filename, "output.png"], shell=False)
77	```
78
79	### Password Storage
80	```python
81	# UNSAFE
82	hashlib.md5(password.encode()).hexdigest()
83
84	# SAFE
85	from argon2 import PasswordHasher
86	PasswordHasher().hash(password)
87	```
88
89	### Access Control
90	```python
91	# UNSAFE - No authorization check
92	@app.route('/api/user/<user_id>')
93	def get_user(user_id):
94	return db.get_user(user_id)
95
96	# SAFE - Authorization enforced
97	@app.route('/api/user/<user_id>')
98	@login_required
99	def get_user(user_id):
100	if current_user.id != user_id and not current_user.is_admin:
101	abort(403)
102	return db.get_user(user_id)
103	```
104
105	### Error Handling
106	```python
107	# UNSAFE - Exposes internals
108	@app.errorhandler(Exception)
109	def handle_error(e):
110	return str(e), 500
111
112	# SAFE - Fail-closed, log context
113	@app.errorhandler(Exception)
114	def handle_error(e):
115	error_id = uuid.uuid4()
116	logger.exception(f"Error {error_id}: {e}")
117	return {"error": "An error occurred", "id": str(error_id)}, 500
118	```
119
120	### Fail-Closed Pattern
121	```python
122	# UNSAFE - Fail-open
123	def check_permission(user, resource):
124	try:
125	return auth_service.check(user, resource)
126	except Exception:
127	return True # DANGEROUS!
128
129	# SAFE - Fail-closed
130	def check_permission(user, resource):
131	try:
132	return auth_service.check(user, resource)
133	except Exception as e:
134	logger.error(f"Auth check failed: {e}")
135	return False # Deny on error
136	```
137
138	## Agentic AI Security (OWASP 2026)
139
140	When building or reviewing AI agent systems, check for:
141
142	\| Risk \| Description \| Mitigation \|
143	\|------\|-------------\|------------\|
144	\| ASI01: Agent Goal Hijacking \| Prompt injection alters agent objectives \| Input sanitization, goal boundaries, behavioral monitoring \|
145	\| ASI02: Tool Misuse \| T

People who liked this also viewed

6 picks

Type