Agent skill · security · davila7
owasp-security
Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the Agentic Applications 2026 edition for AI/LLM. Use for security reviews, vulnerability audits, secure auth/crypto/access-control implementation, Kubernetes manifest hardening, and LLM/agent prompt-injection defense - including indirect requests like "is this login flow secure?", "review this endpoint", or "audit my pod spec".
Why this skill is useful
Provides domain-specific security guidance aligned with multiple OWASP standards that the AI wouldn't reliably generate on its own.
What it needs
About 9k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
Comprehensive OWASP Security Skills A developer-focused security reference covering six OWASP standards for securing web applications, APIs, mobile apps, containers, and AI/LLM systems. Each section provides concise detection guidance, key requirements, and mitigation strategies. Quick Navigation 1. OWASP Top 10 (2021) 2. OWASP ASVS 5.0 3. OWASP MASVS v2.1.0 4. OWASP API Security Top 10 5. OWASP Kubernetes Top 10 6. OWASP Agentic Applications 2026 --- Section 1: OWASP Top 10 (2021) The OWASP Top 10 represents the most critical security risks in web applications. A01: Broken Access Control Detection: URLs with direct ID references (/user/1234/orders); client-side only enforcement; missing authorization checks. Mitigation: Enforce server-side authorization for every sensitive operation; verify user ownership of resources; implement default-deny principle. Example: Checklist: ☐ Authorization on server for all sensitive ops ☐ Default-deny policy ☐ No ID-based obscurity ☐ Whitelist allowed fields --- A02: Cryptographic Failures Detection: Sensitive data in plaintext; weak encryption (DES, ECB); missing TLS; hardcoded secrets in code. Mitigation: Always use HTTPS/TLS; encrypt data at rest with AES-256; store secrets in environment variables or vaults; mask sensitive logs. Example: Checklist: ☐ HTTPS enforced ☐ AES-256 encryption at rest ☐ No secrets in code ☐ Sensitive data masked in logs --- A03: Injection (SQL, Command, NoSQL) Detection: String concatenation in queries; exec, query, run with user input; no prepared statements. Mitigation: Use parameterized queries; whitelist input; avoid string concatenation; use safe APIs (subprocess.run with list args). Example: Checklist: ☐ Parameterized queries only ☐ No string concat ☐ Whitelist input ☐ Safe subprocess calls --- A04: Insecure Design Detection: No threat modeling; missing security controls by design; no authentication/authorization from the start. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/owasp-security