Claude Skill MartBrowse skillsQuick linesLearn by videoTerminal guideWhat is a Skill?
 
← Back to list

OWASP Security Review Skill

Turns Claude into a security reviewer grounded in OWASP Top 10:2025, ASVS 5.0, LLM Top 10 and Agentic AI risks.

Security & ReviewIntermediate★ 333⑂ 31AI score 10/10Last updated: Jul 28, 2026

What it does

  • Summarizes OWASP Top 10:2025 with key prevention guidance per category.
  • Gives a concrete review checklist across input handling, auth/sessions, access control, data protection and error handling.
  • Ships unsafe vs safe code pairs for SQL injection, command injection, password storage, authorization and fail-closed logic.
  • Covers LLM Top 10 (2025) and Agentic AI ASI01–ASI10 (2026) for chatbots, RAG and agent systems.
  • Lists ASVS 5.0 requirements by level (L1/L2/L3) with real requirement IDs, plus a warning that 4.0 IDs don't map to 5.0.
  • Forces a reachability triage (attacker-controlled input → reachable sink → blast radius) before any finding is reported.

Who it's for

  • Backend and full-stack engineers who want Claude to security-review pull requests.
  • Teams implementing authentication, authorization, sessions or crypto against a standard.
  • Builders of RAG, chatbot and agent systems worried about prompt injection and excessive agency.
  • Security engineers writing requirements or reports referencing ASVS 5.0.

Example uses

  1. "Review this login/session module against ASVS 5.0 L1 and L2" → verdicts on password hashing, token entropy, logout invalidation.
  2. "Does this Express route miss an authorization check?" → checks centralized middleware first, then reports only exploitable gaps with the concrete input→sink path.
  3. "Audit our agent's tool definitions" → feedback framed by ASI02 (tool misuse), LLM06 (excessive agency) and LLM05 (output handling).

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/agamm/claude-code-owasp/HEAD/.claude/skills/owasp-security/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the .claude/skills/owasp-security folder from the GitHub repo agamm/claude-code-owasp into my ~/.claude/skills/owasp-security/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/agamm/claude-code-owasp.git /tmp/claude-code-owasp && mkdir -p ~/.claude/skills && cp -r /tmp/claude-code-owasp/.claude/skills/owasp-security ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal.
  2. Clone the repo: git clone https://github.com/agamm/claude-code-owasp.git
  3. Create the skills directory: mkdir -p ~/.claude/skills
  4. Copy the skill including its reference docs: cp -r claude-code-owasp/.claude/skills/owasp-security ~/.claude/skills/
  5. Verify with ls ~/.claude/skills/owasp-security — you should see SKILL.md and a reference/ folder.
  6. Restart Claude Code and ask something like "security review this file"; the skill loads automatically.
  7. For project-scoped use, copy the folder into that project's .claude/skills/ instead of your home directory.
View source on GitHub ↗License: MIT