owasp-security

Review code against OWASP Top 10 and ASVS security requirements.

3|1|Updated Feb 9, 2015
One-click install
npx skills add https://github.com/drafael/dotfiles --skill owasp-security-drafael
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: owasp-security
Source: https://github.com/drafael/dotfiles/tree/main/.agents/skills/owasp-security
Command: npx skills add https://github.com/drafael/dotfiles --skill owasp-security-drafael

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps developers and security professionals identify and mitigate common web application security vulnerabilities, ensuring code is robust and protected against attacks.

Core Features & Use Cases

  • OWASP Top 10 Guidance: Provides quick reference and prevention strategies for the latest OWASP Top 10 vulnerabilities.
  • Security Code Review Checklist: Offers a structured checklist for reviewing code for common security flaws in input handling, authentication, access control, and more.
  • Secure Code Patterns: Demonstrates safe coding practices with examples across various languages to prevent injection, improve authentication, and handle errors securely.
  • Agentic AI Security: Addresses emerging security risks in AI agent systems, including prompt injection, tool misuse, and data poisoning.
  • ASVS Compliance: Outlines key requirements from the Application Security Verification Standard (ASVS) for different application security levels.

Quick Start

Use the owasp-security skill to review the provided Python code snippet for potential injection vulnerabilities.

Frequently Asked Questions about owasp-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my code against the OWASP Top 10 vulnerabilities?

To check code against the OWASP Top 10, use a structured security code review checklist covering access control, authentication, input handling, and cryptographic failures. This provides quick reference prevention strategies and identifies common web application security flaws.

What are the best secure code patterns to prevent injection attacks?

Secure code patterns to prevent injection attacks involve safe coding practices with language-specific examples for input handling and error handling. These patterns mitigate common vulnerabilities by demonstrating robust authentication and access control implementations across various programming languages.

How does ASVS compliance verification work for web application security?

ASVS compliance verification works by outlining key requirements from the Application Security Verification Standard for different application security levels. It provides comprehensive guidance to ensure web applications meet robust security verification thresholds against common vulnerabilities.

Can I review Python code for potential injection vulnerabilities using this guidance?

Yes, you can review Python code for potential injection vulnerabilities using the provided secure code patterns. The skill offers language-specific security considerations and structured checklists to identify and mitigate common flaws in input handling and authentication.

What security risks affect agentic AI systems and how do I mitigate them?

Security risks affecting agentic AI systems include prompt injection, tool misuse, and data poisoning. Mitigation involves applying agentic AI security principles that address these emerging vulnerabilities and ensure robust access control over agent tools and data inputs.

When do I need a security code review checklist for web applications?

You need a security code review checklist when developing or auditing web applications to systematically identify common security flaws. It ensures robust protection against attacks by verifying input handling, authentication, and access control mechanisms against OWASP standards.