code-review-security · owasp — Claude Code skill: OWASP code audit
A skill that reviews code for vulnerabilities against OWASP Top 10 and ASVS, then reports findings with attack scenarios and fixed snippets.
npx skills add OWASP/secure-agent-playbook --skill code-review-security -a claude-codeWhat code-review-security does
The skill follows the procedure in plays/code-review-security.md. It starts by pinning down context: language and framework, trust boundary (server, client, library, CLI), data sensitivity, and whether the code is internet-facing. Then it walks vulnerability classes in priority order — injection, authentication and sessions, authorization, cryptography, data exposure, misconfiguration, deserialization.
Each class has its own checks. Injection covers SQL, command, XSS, SSTI, LDAP, path traversal, headers, and logs. Authorization covers missing checks, IDOR, and privilege escalation. Cryptography covers weak algorithms, hardcoded keys, and hand-rolled schemes. Framework-specific checks kick in for React, Express, Django, Flask, Spring, Rails, and Go.
On a pull request, the analysis narrows to changed lines plus context. The skill checks whether existing controls survived, whether new endpoints match the project's auth patterns, and whether a security check got deleted by accident. Findings come with file:line, the vulnerable snippet, an attack scenario, fixed code, and a confidence rating, plus a severity count table. This is a pre-merge gate, so if the codebase has no authorization checks anywhere, that is worth a full pass rather than a diff-only review.
What it helps with
- screen a pull request for injection before merge
- catch a missing authorization check on a new endpoint
- strip hardcoded keys and credentials out of the code
- trace sensitive data leaking into logs and error messages
- close deserialization and CSRF gaps
Example prompts for the agent
- review this pull request for OWASP Top 10 vulnerabilities
- audit the
src/authmodule for injection and session issues - run a pre-merge security gate and sort findings by severity
How to install code-review-security
1Skills CLI (Vercel)
npx skills add OWASP/secure-agent-playbook --skill code-review-security -a claude-code2Manually: put the files in place
~/.claude/skills/code-review-security/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/code-review-security/
1Skills CLI (Vercel)
npx skills add OWASP/secure-agent-playbook --skill code-review-security -a codex2Manually: put the files in place
.agents/skills/code-review-security/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add OWASP/secure-agent-playbook --skill code-review-security -a cursor2Manually: put the files in place
.cursor/skills/code-review-security/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install OWASP/secure-agent-playbook code-review-security2Manually: put the files in place
.github/skills/code-review-security/SKILL.md1Skills CLI (Vercel)
npx skills add OWASP/secure-agent-playbook --skill code-review-security -a gemini-cli2Platform CLI
gemini skills install https://github.com/OWASP/secure-agent-playbook --path plugins/code-security-skills/skills/code-review-securityManually: put the files in place
.devin/skills/code-review-security/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add OWASP/secure-agent-playbook --skill code-review-security -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about code-review-security
How do I install code-review-security in Claude?
Run npx skills add OWASP/secure-agent-playbook --skill code-review-security -a claude-code. The skill lands in ~/.claude/skills/code-review-security/SKILL.md.
What does code-review-security do?
It reviews code for vulnerabilities mapped to OWASP Top 10 and ASVS: injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization. Findings include file:line, an attack scenario, and fixed code.
Which platforms support the skill?
Claude, Codex, Cursor, GitHub Copilot, Gemini CLI, and OpenCode. Each platform has its own install command.
Source text
SKILL.md · CC-BY-4.0
--- name: code-review-security description: Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization. license: CC-BY-4.0 --- # Security Code Review Review code for security vulnerabilities by following the full procedure in `plays/code-review-security.md`. ## Steps 1. **Scope & Context** — Establish language/framework, trust boundary (server/client/library/CLI), data sensitivity (PII, credentials, financial), and exposure (internet-facing, internal, local). 2. **Systematic Review by Vulnerability Class** (priority order): - **Injection (A03)** — SQL, command, XSS, SSTI, LDAP, path traversal, header, log injection - **Authentication & Session (A07)** — Hardcoded credentials, missing auth, weak sessions, JWT issues - **Authorization (A01)** — Missing authz checks, IDOR, horizontal/vertical privilege escalation - **Cryptography (A02)** — Weak algorithms, hardcoded keys, missing encryption, custom crypto - **Data Exposure (A01)** — Sensitive data in errors/logs, credentials in code, debug mode - **Misconfiguration (A05)** — Default credentials, permissive CORS, missing security headers - **Deserialization (A08)** — Untrusted deserialization, missing integrity checks, CSRF gaps 3. **Framework-Specific Checks** — Apply checks for detected framework (React, Express, Django, Flask, Spring, Rails, Go). 4. **Diff-Specific Analysis** (for PRs) — Focus on changed lines plus context, verify security controls preserved, check new endpoints match auth patterns, look for removed security controls. 5. **Produce Findings** — Cite file:line, show vulnerable snippet, explain attack scenario, provide fixed code, rate confidence. ## Output Scope summary, findings sorted by severity using `templates/finding.md`, positive observations (good security controls in place), and severity count table. ## OWASP References - OWASP Top 10 (2021): A01-A10 - OWASP ASVS v5.0 - OWASP Code Review Guide - OWASP Cheat Sheet Series
© OWASP · CC-BY-4.0 · OWASP/secure-agent-playbook
Similar skills
Everything for Security →code-review-security by other authors comes first.
