web-security-baseline

To check code diffs for OWASP Top 10 web security vulnerabilities, this skill performs a baseline security review targeting HTTP handlers, authentication logic, and database queries to detect injection, access control, and SSRF risks. It outputs explicit BLOCKING, WARN, and NIT findings with evidence-based fix guidance.

You should run an OWASP baseline security review when pull request diffs touch HTTP handlers, authentication flows, session/cookie logic, URL/redirect parsing, file uploads, database queries with user input, or outbound URL/proxy fetching. This prevents insecure web application changes from reaching production.

Yes, this security review detects SSRF and broken access control in URL parsing logic. It applies checklist-driven detection specifically to outbound URL/proxy fetching and redirect parsing, enforcing defense-in-depth and treating identified integrity risks as blockers until explicitly acknowledged.

To fix security logging gaps and injection risks, this web security review provides actionable output with severity labels, file locations, and exploit vectors. It includes evidence-based fix guidance with references to OWASP, CWE, and CVE standards to resolve the flagged database query vulnerabilities.

Yes, you can use this skill to review authentication and session cookie logic for misconfigurations. It specifically targets authN and authZ failures, applying special escalation rules to sensitive categories and enforcing defense-in-depth to reduce production incidents from insecure code.