OWASP
Official@owasp · United States of America
The OWASP Foundation
Agent Skills by OWASP
Showing 16 vetted skills indexed across 1 GitHub repositories.
OWASPai-security-verification
Verify AI applications against the AISVS framework and generate a compliance checklist.
OWASPmulti-agentic-threat-model
Identify and quantify security threats across the seven MAESTRO layers.
OWASPagentic-ai-risk-assess
Assess agentic AI risks using the OWASP Top 10 for Agentic Applications 2026.
OWASPcode-review-security
Map code review findings to OWASP Top 10 and ASVS.
OWASPsecurability-engineering
Enforce OWASP FIASSE and SSEM securable coding attributes during code generation.
OWASPprompt-injection-test
Test prompt-injection vulnerabilities in LLM-integrated applications using the Arcanum PI Taxonomy.
OWASPagent-security-audit
Enumerate permissions, data flows, and guardrails to produce a structured security audit report.
OWASPsca-audit
Scan project manifests and lockfiles for known CVEs across multiple ecosystems.
OWASPsecrets-scan
Detect hardcoded secrets in source code and configuration files.
OWASPmcp-server-review
Audits MCP server implementations for security risks across seven defined review areas.
OWASPiac-security-review
Identify security misconfigurations in Terraform, Kubernetes, CloudFormation, and Helm IaC files.
OWASPsecurability-engineering-review
Assesses code securability via OWASP FIASSE/SSEM framework and generates weighted pillar report.
OWASPsecurity-guidance
Apply OWASP ASVS-based security guidance to development tasks with inline citations.
OWASPweb-security-review
Identify OWASP Top 10 security risks in web applications.
OWASPapi-security-review
Identify and assess API security weaknesses across OpenAPI/Swagger specs and implementations.
OWASPllm-risk-assess
Assess LLM application security risks against the OWASP Top 10 for LLMs 2025.
Frequently Asked Questions About OWASP
FAQPage SchemaWhat specific security tasks are enabled by these frameworks?▼
These frameworks enable systematic identification of vulnerabilities including prompt injection, hardcoded secrets, and IaC misconfigurations. They facilitate mapping code review findings to established security standards like ASVS and the OWASP Top 10, ensuring comprehensive coverage across web, infrastructure, and emerging application layers.
Which technical personas benefit from these security methodologies?▼
Security engineers, DevSecOps practitioners, and software architects utilize these methodologies to enforce secure coding attributes. These resources are designed for technical teams responsible for maintaining compliance, performing threat modeling, and conducting rigorous security audits across diverse software development lifecycles.
What are the prerequisites for implementing these security standards?▼
Implementation requires access to project source code, configuration manifests, or OpenAPI specifications. Users must possess foundational knowledge of the specific OWASP framework being applied, such as the Top 10 for LLMs or the ASVS verification levels, to effectively interpret findings and apply remediation guidance.