OWASP Security Skill
OWASP Top 10, ASVS 5.0, and agentic-AI security reviews for Claude Code.
About
A security-review skill that walks an agent through a five-step checklist covering OWASP Top 10:2025, ASVS 5.0, the 2026 LLM Top 10, and the agentic-AI risk list, with language-specific quirks for 20+ languages and a triage rubric aimed at cutting false positives.
It ships reference files instead of one giant prompt, plus an eval suite so authors can measure whether the skill actually improves findings. It is a static review guide — it does not run dynamic scans or exploit anything, so findings still need a human to confirm reachability.
What it can do
- Five-step security review workflow
- Finding-triage rubric to reduce false positives
- OWASP Top 10:2025 quick reference
- OWASP Top 10 for LLM Applications (2026)
- OWASP Agentic AI Security (2026) list
- ASVS 5.0 requirements with real requirement IDs
- Language-specific security quirks for 20+ languages
- Config and supply-chain checks (Docker, K8s, Terraform, CI)
- Fixed reporting format with severity by exploitability
- Eval suite to measure the skill's added value
Setup
- Run the install command to copy the skill folder into your Claude Code skills directory.
- Restart your Claude Code session so the skill is discovered.
- Ask for a security review in plain language, e.g. "review this code for security issues".
Prerequisites
Claude Code installed. No API keys or extra dependencies.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (verified tier, metrics-v1). Evidence: 378 GitHub stars, 35 forks; 27 commits, active through 2026; standards verified against owasp.org, ASVS repo, and GenAI security PDFs; ships an eval suite for measuring the skill's value. License: MIT.
★ 378 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 7.0/10
- Maintenance · recency, releases, issue load
- 6.0/10
- Openness · license + docs
- 8.0/10
- Manual review · sanity read + red-flag check
- 7.0/10
- · 378 GitHub stars, 35 forks
- · 27 commits, active through 2026
- · standards verified against owasp.org, ASVS repo, and GenAI security PDFs
- · ships an eval suite for measuring the skill's value
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.