OWASPOfficial·16 Agent Skills Included

secure-agent-playbook

OWASP security reviews for code, APIs, and AI systems

Runs structured OWASP-based security reviews of code, APIs, mobile apps, infrastructure, and AI agents. Detects vulnerabilities, leaked secrets, and risky dependencies with severity ratings, CWE mappings, and fix-ready remediation steps. Replaces ad-hoc prompting with repeatable audit procedures that produce consistent, evidence-backed findings.

141|14

↗

npx skills add OWASP/secure-agent-playbook --all -g -y

Available:

Instructs the agent to act as a defensive security researcher, follow the playbook's review checklist, and report every finding with severity, CWE references, evidence, and remediation steps.

All Skills in This Repository (16)

Pure Emerald Level Indicators

📦 In Repo

OWASP

ai-security-verification

Verify AI applications against the AISVS framework and generate a compliance checklist.

multi-agentic-threat-model

Identify and quantify security threats across the seven MAESTRO layers.

agentic-ai-risk-assess

Assess agentic AI risks using the OWASP Top 10 for Agentic Applications 2026.

code-review-security

Map code review findings to OWASP Top 10 and ASVS.

securability-engineering

Enforce OWASP FIASSE and SSEM securable coding attributes during code generation.

prompt-injection-test

Test prompt-injection vulnerabilities in LLM-integrated applications using the Arcanum PI Taxonomy.

agent-security-audit

Enumerate permissions, data flows, and guardrails to produce a structured security audit report.

sca-audit

Scan project manifests and lockfiles for known CVEs across multiple ecosystems.

secrets-scan

Detect hardcoded secrets in source code and configuration files.

mcp-server-review

Audits MCP server implementations for security risks across seven defined review areas.

iac-security-review

Identify security misconfigurations in Terraform, Kubernetes, CloudFormation, and Helm IaC files.

securability-engineering-review

Assesses code securability via OWASP FIASSE/SSEM framework and generates weighted pillar report.

Official

Advanced

Frequently Asked Questions

FAQPage Schema

How to install secure-agent-playbook?▼

Run `npx skills add OWASP/secure-agent-playbook --all -g -y` in your terminal to install all security skills globally.

How to run an OWASP security review on my code?▼

After installing, just ask your agent to review code for security issues and it follows the OWASP Top 10 and ASVS procedure automatically. Findings include severity, CWE references, evidence, and fixed code examples.

Can it audit AI agents and LLM apps for security?▼

Yes. It includes dedicated skills for prompt injection testing, LLM risk assessment, MCP server review, and multi-agent threat modeling based on OWASP LLM and Agentic Top 10 standards.

Does it scan dependencies and secrets?▼

Yes. The sca-audit skill scans dependency files for known CVEs, and the secrets-scan skill detects hardcoded credentials and API keys using tools like trufflehog and gitleaks.

Do I need security expertise to use it?▼

No. Each skill follows a step-by-step OWASP procedure, so plain-English requests like 'scan my dependencies for CVEs' produce professional-grade, structured security reports.