owasp

Analyze code against OWASP Top 10 vulnerability categories with parallel subagents.

12|1|Updated Feb 9, 2026

Search Tags:#code analysis #security #owasp #penetration testing #web application #vulnerability scanning

Ready to run

npx skills add https://github.com/florianbuetow/claude-code --skill owasp-florianbuetow

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: owasp
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/owasp
Command: npx skills add https://github.com/florianbuetow/claude-code --skill owasp-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the detection of common web application security vulnerabilities as defined by the OWASP Top 10, helping to secure your codebase.

Core Features & Use Cases

Comprehensive Coverage: Analyzes code against all 10 OWASP Top 10 categories (2021).
Parallel Subagents: Dispatches specialized subagents for each vulnerability category for efficient analysis.
Severity Ranking & Filtering: Consolidates findings, deduplicates them, and ranks them by severity, with options to filter by specific categories or severity levels.
Use Case: Before deploying a new web service, run an OWASP analysis to identify and remediate critical security flaws like injection vulnerabilities, broken access control, or insecure configurations.

Quick Start

Run an OWASP analysis on the current project's changed files, focusing on injection and broken access control vulnerabilities.

Frequently Asked Questions about owasp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my web application for OWASP Top 10 vulnerabilities?▼

Scanning for OWASP Top 10 vulnerabilities is done by dispatching parallel subagents to analyze your code against all 10 categories. It ranks findings by severity and optionally filters by specific vulnerability categories or severity levels to help remediate critical security flaws.

Can I filter vulnerability scanning results to only show injection flaws?▼

Yes, vulnerability scanning results can be filtered by specific categories or severity levels. The analysis scopes to specified code files and supports filtering, allowing you to isolate specific vulnerability categories like injection flaws or broken access control.

What is the best way to analyze code for broken access control vulnerabilities?▼

Running an OWASP analysis that dispatches specialized subagents for each vulnerability category is an effective way to analyze code for broken access control. It provides comprehensive coverage across all OWASP Top 10 categories and ranks the discovered flaws by severity.

Does the OWASP analysis support simulated exploitation for penetration testing?▼

Yes, the OWASP analysis supports an optional expert mode for simulated exploitation. This mode goes beyond standard vulnerability scanning by simulating exploitation and providing DREAD scoring to help assess the actual risk and impact of identified web application security flaws.

How does parallel subagent analysis improve security vulnerability scanning?▼

Parallel subagent analysis improves security vulnerability scanning by dispatching a specialized subagent for each of the 10 OWASP Top 10 categories simultaneously. This approach efficiently provides comprehensive coverage, consolidating and deduplicating findings before ranking them by severity.