skills.rest
MWest2020
MWest2020COMMUNITY
Explore all skills by this author →
𝕏@MarkWesterweelGitHub

owasp-security

Review code against OWASP Top 10, ASVS 5.0, LLM, and agentic AI security standards.

Updated May 24, 2026
Search Tags:#code review#authentication#vulnerability#owasp#injection#security review#llm security
One-click install
npx skills add https://github.com/MWest2020/skill-forge --skill owasp-security-mwest2020
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: owasp-security
Source: https://github.com/MWest2020/skill-forge/tree/main/skills/owasp-security
Command: npx skills add https://github.com/MWest2020/skill-forge --skill owasp-security-mwest2020

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security vulnerabilities like injection, broken access control, and insecure deserialization slip into code when developers lack a structured checklist during writing and review. This Skill provides consolidated OWASP guidance so code reviews and implementations consistently cover web, LLM, and agentic AI threat categories. ## Core Features & Use Cases - OWASP Top 10:2025 Quick Reference: A prevention table covering all ten vulnerability classes from broken access control to exception handling failures. - Security Review Checklists: Checkbox lists for input handling, authentication, access control, data protection, and error handling, plus dedicated checklists for LLM applications and AI agents. - Language-Specific Pitfalls: Unsafe/safe code patterns for 20 languages including Python, JavaScript, Java, Go, Rust, PHP, and C/C++, covering issues like pickle deserialization, prototype pollution, and buffer overflows. - Use Case: While reviewing a Flask API endpoint, apply the access control checklist to catch missing authorization decorators and the SQL injection patterns to verify parameterized queries. ## Quick Start Review this authentication module for OWASP Top 10 vulnerabilities and list any unsafe patterns with fixes.

Frequently Asked Questions about owasp-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code for OWASP Top 10 vulnerabilities?▼

Work through the OWASP Top 10:2025 quick reference table and the security review checklist covering input handling, authentication, access control, data protection, and error handling. Compare flagged code against the unsafe and safe pattern examples provided for each vulnerability class.

What are the main LLM application security risks?▼

The OWASP LLM Top 10 covers prompt injection, sensitive information disclosure, supply chain risks, improper output handling, excessive agency, and unbounded consumption. Key mitigations include treating LLM output as untrusted, minimizing tool permissions, and enforcing per-user token budgets.

Does this cover security for AI agents and MCP tools?▼

Yes, it includes the OWASP Agentic AI security risks (ASI01-ASI10) covering goal hijacking, tool misuse, identity abuse, memory poisoning, and rogue agents. A dedicated checklist addresses scoped credentials, sandboxed execution, and human approval gates.

Which programming languages have specific security guidance?▼

Twenty languages are covered including Python, JavaScript, Java, C#, PHP, Go, Ruby, Rust, C/C++, Swift, Kotlin, and SQL. Each section lists main risks, unsafe versus safe code examples, and dangerous functions to watch for.

What are the limitations of checklist-based security review?▼

The language-specific examples are illustrative starting points, not exhaustive coverage. Deeper analysis requires researching each language's CWE patterns, CVE history, memory model, and ecosystem-specific attack vectors beyond the listed examples.

Related Skills

Explore More Software Engineering Skills→
OneWave-AIOneWave-AI
245

code-review-pro

Review code for security vulnerabilities, performance bottlenecks, and maintainability issues.

Official
Basic
omeraltnomeraltn

agency-security-engineer

Identify and prioritize security vulnerabilities in web, API, and cloud-native applications.

Community
Advanced
xlelibertyxleliberty

security-pen-testing

Perform offensive security assessments with vulnerability scanning and penetration testing.

Community
Advanced
anavvanzinanavvanzin

agency-security-engineer

Identify and mitigate security risks across web, API, and cloud-native applications.

Community
Advanced