skills.rest
HoussamMrabet
HoussamMrabetCOMMUNITY
Explore all skills by this author →
Website𝕏@MrabetHoussamGitHub

owasp-security

Review code against OWASP Top 10, ASVS 5.0, LLM, and agentic AI security standards.

Updated Aug 9, 2026
Search Tags:#code review#authentication#vulnerability#owasp#security review#prompt injection#llm security
One-click install
npx skills add https://github.com/HoussamMrabet/ultimate-TicTacToe --skill owasp-security-houssammrabet
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: owasp-security
Source: https://github.com/HoussamMrabet/ultimate-TicTacToe/tree/main/skills/owasp-security
Command: npx skills add https://github.com/HoussamMrabet/ultimate-TicTacToe --skill owasp-security-houssammrabet

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Developers and reviewers often miss security vulnerabilities like injection flaws, broken access control, weak cryptography, and prompt injection because security guidance is scattered across many standards. This Skill consolidates OWASP Top 10:2025, ASVS 5.0, LLM Top 10 (2025), and Agentic AI security (2026) into actionable checklists and safe/unsafe code patterns. ## Core Features & Use Cases - Security Code Review Checklists: Structured checks for input handling, authentication, access control, data protection, and error handling mapped to OWASP categories. - Safe/Unsafe Code Patterns: Side-by-side examples for SQL injection, command injection, password hashing, fail-closed authorization, and LLM output handling. - AI-Specific Coverage: Dedicated guidance for prompt injection, excessive agency, unbounded consumption, and the ten agentic AI risks (ASI01–ASI10). - Per-Language Quirks: Reference file covering security pitfalls for 20+ languages including Python, JavaScript, Go, Rust, PHP, and C/C++. - Use Case: While reviewing a Flask API pull request, apply the checklist to catch a missing authorization decorator, an f-string SQL query, and a fail-open permission check before merge. ## Quick Start Review this authentication module for OWASP Top 10 vulnerabilities and suggest fixes for any issues found.

Frequently Asked Questions about owasp-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code for OWASP Top 10 vulnerabilities?▼

Apply the security code review checklist covering input handling, authentication, access control, data protection, and error handling. Compare suspicious code against the provided unsafe/safe patterns for injection, password storage, and fail-closed authorization.

How to prevent prompt injection in LLM applications?▼

Separate trusted system instructions from untrusted user data using clear delimiters like XML tags, and instruct the model to treat tagged content as data only. Also validate all LLM output before it reaches SQL, shell, HTML, or tool calls.

What password hashing algorithm should I use?▼

Use Argon2 or bcrypt for password storage, never MD5 or SHA1. ASVS 5.0 also requires passwords of at least 12 characters checked against breached password lists, plus rate limiting on authentication endpoints.

Does this cover language-specific security issues?▼

Yes, the reference file covers security quirks for over 20 languages including Python pickle deserialization, JavaScript prototype pollution, PHP type juggling, Go race conditions, and Rust unsafe blocks, each with unsafe and safe examples.

What are the main security risks for AI agent systems?▼

The OWASP Agentic AI Top 10 covers goal hijacking, tool misuse, privilege abuse, supply chain vulnerabilities, unexpected code execution, memory poisoning, insecure inter-agent communication, cascading failures, trust exploitation, and rogue agents.

When should I not rely only on this checklist?▼

Checklists are entry points, not complete coverage. For critical systems, combine them with threat modeling, penetration testing, and ASVS Level 3 verification, and research language-specific CVE history beyond the listed examples.

Related Skills

Explore More Software Engineering Skills→
queen-of-codequeen-of-code
8

agent-security-review

Review PR diffs for vulnerabilities, secrets, and misconfigurations.

Community
Intermediate
aymenhamoudiiaymenhamoudii

best-practices

Audit web applications for security, compatibility, performance, and code quality issues.

Community
Intermediate
OWASPOWASP
141

secrets-scan

Detect hardcoded secrets in source code and configuration files.

Official
Intermediate
KentoShimizuKentoShimizu
7

security-vulnerability-management

Prioritize and drive vulnerabilities from SAST/DAST scans to closure.

Community
Advanced