OWASP Security Review

Reviews code and diffs against OWASP Top 10:2025, ASVS 5.0, and the 2026 LLM and Agentic Top 10 lists with a disciplined, low-false-positive workflow.

Security & ReviewIntermediate★ 367⑂ 34AI score 9/10Last updated: Sep 25, 2026

What it does

Reviews against current standards: OWASP Top 10:2025 (A01–A10), ASVS 5.0 levels, OWASP Top 10 for LLM Applications (2026), and Top 10 for Agentic Applications (2026).
Five-step review workflow: map entry points and trust boundaries → load only the references the code needs → sweep for candidates → triage each one → report by severity, with a progress checklist pasted into the response.
False-positive discipline: "a pattern match is not a vulnerability." A finding ships only after confirming attacker-controlled input, reachable sink, blast radius, and that every exploit step is actually possible.
Standard report format: [SEVERITY] Title (CWE/OWASP/LLM/ASI ID), file:line, entry-point→sink path, impact, concrete fix, and confidence (Confirmed / Likely / Needs verification).
Bundled references: per-category checklist, unsafe/safe pitfalls for 20+ languages, config/IaC/CI and supply-chain guidance, plus a ~1,100-line deep-dive report.

Who it's for

Backend and full-stack engineers who want a security pass on a PR before merging
Teams hand-rolling authentication, authorization, sessions, or cryptography
Developers shipping LLM chatbots, RAG, MCP servers, or agents who worry about prompt injection and excessive agency
Security engineers who want ASVS 5.0 turned into an actionable checklist

Example uses

"Security review this diff" → entry points mapped, language section loaded, SQLi/IDOR/SSRF candidates traced, severity-ordered report produced.
"Harden this Dockerfile and GitHub Actions workflow" → least-privilege, pinned versions, lockfile integrity, and secret exposure checked against the config/supply-chain reference.
"Is our RAG chatbot exposed to prompt injection?" → checked against LLM01/LLM08/LLM10 and ASI01/ASI06 for context fencing, output handling, and vector-store tenant isolation.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/agamm/claude-code-owasp/HEAD/.claude/skills/owasp-security/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)

Download the ZIP with the button below.
In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.

↓ Download ZIP

Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the .claude/skills/owasp-security folder from the GitHub repo agamm/claude-code-owasp into my ~/.claude/skills/owasp-security/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/agamm/claude-code-owasp /tmp/claude-code-owasp && mkdir -p ~/.claude/skills && cp -r /tmp/claude-code-owasp/.claude/skills/owasp-security ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

Open a terminal.
Clone the repo: git clone https://github.com/agamm/claude-code-owasp
Create the skills directory: mkdir -p ~/.claude/skills
Copy the skill, including its reference folder: cp -r claude-code-owasp/.claude/skills/owasp-security ~/.claude/skills/
Verify: ls ~/.claude/skills/owasp-security should show SKILL.md and reference/.
Restart Claude Code and ask "security review this code" or "check this against OWASP" to trigger the skill.
To scope it to one project only, copy it into that project's .claude/skills/ instead of ~/.claude/skills.

View source on GitHub ↗License: MIT