owasp-security-review

Name: owasp-security-review
Author: jgamaraalv

50installs0forks

How to install owasp-security-review?

jgamaraalv/ts-dev-kit/owasp-security-review

$npx -y skills add jgamaraalv/ts-dev-kit --skill owasp-security-review

Installs into the current project.

Summary

Review code and architectures against the OWASP Top 10:2025 — the ten most critical web application security risks. Use when: (1) reviewing code for security vulnerabilities, (2) auditing a feature or codebase against OWASP categories, (3) providing remediation guidance for ident

Files · 1

View on GitHub

SKILL.md

1	# OWASP Top 10:2025 Security Review
2
3	<quick_reference>
4
5	## Quick reference
6
7	\| # \| Category \| Key risk \| Avg incidence \|
8	\| --- \| ------------------------------------- \| ---------------------------------------------------------------------- \| ------------- \|
9	\| A01 \| Broken Access Control \| Unauthorized data access, privilege escalation, SSRF, CSRF \| 3.74% \|
10	\| A02 \| Security Misconfiguration \| Default creds, verbose errors, missing hardening, XXE \| 3.00% \|
11	\| A03 \| Software Supply Chain Failures \| Vulnerable/malicious dependencies, compromised build pipelines \| 5.72% \|
12	\| A04 \| Cryptographic Failures \| Weak algorithms, hardcoded keys, missing encryption, weak hashing \| 3.80% \|
13	\| A05 \| Injection \| SQLi, XSS, command injection, LDAP/XPath/EL injection \| 3.08% \|
14	\| A06 \| Insecure Design \| Missing threat modeling, business logic flaws, insufficient controls \| 1.86% \|
15	\| A07 \| Authentication Failures \| Credential stuffing, weak passwords, session fixation, missing MFA \| 2.92% \|
16	\| A08 \| Software/Data Integrity Failures \| Unsigned updates, insecure deserialization, untrusted CDN code \| 2.75% \|
17	\| A09 \| Security Logging & Alerting Failures \| Missing audit logs, no alerting, log injection, sensitive data in logs \| 3.91% \|
18	\| A10 \| Mishandling of Exceptional Conditions \| Failing open, info leakage via errors, unchecked return values \| 2.95% \|
19
20	## Severity classification
21
22	Use these severity levels when reporting findings:
23
24	- Critical: Directly exploitable, leads to full system compromise or mass data breach (e.g., SQLi with no parameterization, hardcoded admin credentials, missing auth on admin endpoints).
25	- High: Exploitable with moderate effort, significant data exposure or privilege escalation (e.g., IDOR, weak password hashing, SSRF, deserialization of untrusted data).
26	- Medium: Exploitable under specific conditions, limited impact (e.g., missing CSRF protection, verbose error messages, missing security headers).
27	- Low: Defense-in-depth issue, minimal direct impact (e.g., missing rate limiting, incomplete logging, suboptimal crypto configuration).
28
29	</quick_reference>
30
31	<workflow>
32
33	## Workflows
34
35	<phase_1_code_review>
36	### Code review for security
37
38	Systematically check the code against each relevant category:
39
40	1. Identify the code's surface area — Does it handle auth? User input? File uploads? External data? Crypto? Error responses?
41	2. Select relevant categories from the table above based on the surface area.
42	3. Load the reference file for each relevant category and check the code against the "What to look for" section.
43	4. Report findings grouped by category with severity (Critical/High/Medium/Low), the specific code location, and a concrete fix.
44
45	Priority order for review (highest impact first):
46
47	- `[CRITICAL]` Input handling code → A05 (Injection), A01 (Access Control)
48	- `[CRITICAL]` Auth/session code → A07 (Authentication), A01 (Access Control)
49	- `[HIGH]` Data storage/transmission → A04 (Cryptographic Failures)
50	- `[HIGH]` Configuration/deployment → A02 (Security Misconfiguration)
51	- `[HIGH]` Dependencies → A03 (Supply Chain)
52	- `[MEDIUM]` Error handling → A10 (Exceptional Conditions), A09 (Logging)
53	- `[MEDIUM]` Architecture/design → A06 (Insecure Design)
54	- `[MEDIUM]` Data integrity → A08 (Integrity Failures)
55	</phase_1_code_review>
56
57	<phase_2_audit_checklist>
58	### Security audit checklist
59
60	Generate a checklist for a feature or codebase:
61
62	1. Read the feature/codebase to understand its scope.
63	2. For each of the 10 categories, determine if it applies.
64	3. For applicable categories, load the reference file and produce a checklist of items to verify.
65	4. Output a markdown checklist grouped by category.
66	</phase_2_audit_checklist>
67
68	<phase_3_remediation>
69	### Remediation guidance
70
71	When a vulnerability is identified:
72
73	1. Classify it into the correct OWASP category.
74	2. Load the corresponding reference file.
75	3. Apply the prevention checklist to produce a specific, actionable fix.
76	4. Provide a code example of the fix when possible.
77	</phase_3_remediation>
78
79	</workflow>
80
81	<references>
82
83	#

People who liked this also viewed

6 picks

Type

owasp-security-review

50installs0forks

View on GitHub

How to install owasp-security-review?

jgamaraalv/ts-dev-kit/owasp-security-review

$npx -y skills add jgamaraalv/ts-dev-kit --skill owasp-security-review

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# OWASP Top 10:2025 Security Review
2
3	<quick_reference>
4
5	## Quick reference
6
7	\| # \| Category \| Key risk \| Avg incidence \|
8	\| --- \| ------------------------------------- \| ---------------------------------------------------------------------- \| ------------- \|
9	\| A01 \| Broken Access Control \| Unauthorized data access, privilege escalation, SSRF, CSRF \| 3.74% \|
10	\| A02 \| Security Misconfiguration \| Default creds, verbose errors, missing hardening, XXE \| 3.00% \|
11	\| A03 \| Software Supply Chain Failures \| Vulnerable/malicious dependencies, compromised build pipelines \| 5.72% \|
12	\| A04 \| Cryptographic Failures \| Weak algorithms, hardcoded keys, missing encryption, weak hashing \| 3.80% \|
13	\| A05 \| Injection \| SQLi, XSS, command injection, LDAP/XPath/EL injection \| 3.08% \|
14	\| A06 \| Insecure Design \| Missing threat modeling, business logic flaws, insufficient controls \| 1.86% \|
15	\| A07 \| Authentication Failures \| Credential stuffing, weak passwords, session fixation, missing MFA \| 2.92% \|
16	\| A08 \| Software/Data Integrity Failures \| Unsigned updates, insecure deserialization, untrusted CDN code \| 2.75% \|
17	\| A09 \| Security Logging & Alerting Failures \| Missing audit logs, no alerting, log injection, sensitive data in logs \| 3.91% \|
18	\| A10 \| Mishandling of Exceptional Conditions \| Failing open, info leakage via errors, unchecked return values \| 2.95% \|
19
20	## Severity classification
21
22	Use these severity levels when reporting findings:
23
24	- Critical: Directly exploitable, leads to full system compromise or mass data breach (e.g., SQLi with no parameterization, hardcoded admin credentials, missing auth on admin endpoints).
25	- High: Exploitable with moderate effort, significant data exposure or privilege escalation (e.g., IDOR, weak password hashing, SSRF, deserialization of untrusted data).
26	- Medium: Exploitable under specific conditions, limited impact (e.g., missing CSRF protection, verbose error messages, missing security headers).
27	- Low: Defense-in-depth issue, minimal direct impact (e.g., missing rate limiting, incomplete logging, suboptimal crypto configuration).
28
29	</quick_reference>
30
31	<workflow>
32
33	## Workflows
34
35	<phase_1_code_review>
36	### Code review for security
37
38	Systematically check the code against each relevant category:
39
40	1. Identify the code's surface area — Does it handle auth? User input? File uploads? External data? Crypto? Error responses?
41	2. Select relevant categories from the table above based on the surface area.
42	3. Load the reference file for each relevant category and check the code against the "What to look for" section.
43	4. Report findings grouped by category with severity (Critical/High/Medium/Low), the specific code location, and a concrete fix.
44
45	Priority order for review (highest impact first):
46
47	- `[CRITICAL]` Input handling code → A05 (Injection), A01 (Access Control)
48	- `[CRITICAL]` Auth/session code → A07 (Authentication), A01 (Access Control)
49	- `[HIGH]` Data storage/transmission → A04 (Cryptographic Failures)
50	- `[HIGH]` Configuration/deployment → A02 (Security Misconfiguration)
51	- `[HIGH]` Dependencies → A03 (Supply Chain)
52	- `[MEDIUM]` Error handling → A10 (Exceptional Conditions), A09 (Logging)
53	- `[MEDIUM]` Architecture/design → A06 (Insecure Design)
54	- `[MEDIUM]` Data integrity → A08 (Integrity Failures)
55	</phase_1_code_review>
56
57	<phase_2_audit_checklist>
58	### Security audit checklist
59
60	Generate a checklist for a feature or codebase:
61
62	1. Read the feature/codebase to understand its scope.
63	2. For each of the 10 categories, determine if it applies.
64	3. For applicable categories, load the reference file and produce a checklist of items to verify.
65	4. Output a markdown checklist grouped by category.
66	</phase_2_audit_checklist>
67
68	<phase_3_remediation>
69	### Remediation guidance
70
71	When a vulnerability is identified:
72
73	1. Classify it into the correct OWASP category.
74	2. Load the corresponding reference file.
75	3. Apply the prevention checklist to produce a specific, actionable fix.
76	4. Provide a code example of the fix when possible.
77	</phase_3_remediation>
78
79	</workflow>
80
81	<references>
82
83	#

People who liked this also viewed

6 picks

Type