owasp-security
Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the Agentic Applications 2026 edition for AI/LLM. Use for security reviews, vulnerability audits, secure auth/crypto/access-control implementation, Kubernetes manifest hardening, and LLM/agent prompt-injection defense - including indirect requests like "is this login flow secure?", "review this endpoint", or "audit my pod spec".
Target: Cloud, operations & security. Automatically collected · unverified.
Excerpt from the author’s documentation
Extracted from a fixed version of SKILL.md in its original language. This is the author’s documentation; installation, compatibility and runtime results have not been verified by this site.
Read the original English text
Topics in the source
- Comprehensive OWASP Security Skills
- Quick Navigation
- Section 1: OWASP Top 10 (2021)
- A01: Broken Access Control
- A02: Cryptographic Failures
- A03: Injection (SQL, Command, NoSQL)
- A04: Insecure Design
- A05: Security Misconfiguration
A developer-focused security reference covering six OWASP standards for securing web applications, APIs, mobile apps, containers, and AI/LLM systems. Each section provides concise detection guidance, key requirements, and mitigation strategies. 1. OWASP Top 10 (2021) 2. OWASP ASVS 5.0 3. OWASP MASVS v2.1.0 4. OWASP API Security Top 10 5. OWASP Kubernetes Top 10 6. OWASP Agentic Applications 2026 -- The OWASP Top 10 represents the most critical security risks in web applications. Detection: URLs with direct ID references (/user/1234/orders); client-side only enforcement; missing authorization checks. Mitigation: Enforce server-side authorization for every sensitive operation; verify user ownership of resources; implement default-deny principle. Example: Checklist: ☐ Authorization on server for all sensitive ops ☐ Default-deny policy ☐ No ID-based obscurity ☐ Whitelist allowed fields -- Detection: Sensitive data in plaintext; weak encryption (DES, ECB); missing TLS; hardcoded secrets in code. Mitigation: Always use HTTPS/TLS; encrypt data at rest with AES-256; store secrets in environment variables or vaults; mask sensitive logs. Example: Checklist: ☐ HTTPS enforced ☐ AES-256 encrypt
This is an excerpt. Refer to the complete source and its current requirements.
- Source repository
- davila7/claude-code-templates
- Source file
- .claude-plugin/skills/owasp-security/SKILL.md
- Fixed revision
- 21be197f100a12b8d0dd9a211cc244c8179f84d3
Sources and evidence
This record was collected automatically. Its documentation, suitability and runtime behavior have not been manually verified.
Author: davila7/claude-code-templates · original repository metadata. Documentation review: Not reviewed. Last source check: 2026-11-09T14:01:42.912Z.
Categories are inferred from names, descriptions and paths. They do not establish compatibility.
License and attribution
MIT. Third-party content and copyright remain with their authors. Refer to the original license and terms.
Original license ↗Synchronization, copying and user-reported success do not mark a resource as runtime-tested.
Limitations and notes
- Collecting metadata does not mean this site has installed, adapted, runtime-tested or security-reviewed the resource.