owasp-security · hoodini — Claude Code skill: OWASP Top 10 checks
A skill that hands your agent the OWASP Top 10 playbook: access control, injection, crypto, misconfig. Useful while writing auth or touching an API.
npx skills add hoodini/ai-agents-skills --skill owasp-security -a claude-codeWhat owasp-security does
The skill loads a reference on OWASP Top 10 (2021) into the agent's context — a table of ten categories with their countermeasures, plus code samples under each. Bad and good versions sit side by side, so the agent can see the difference instead of copying an old pattern into a new file.
Covered in the samples: ownership and role checks with RBAC, password hashing through bcrypt, aes-256-gcm encryption, helmet headers, parameterized queries instead of string building, zod input validation, request rate limits, and shell injection avoided with execFile. Everything is TypeScript.
The code leans on named libraries — bcrypt, helmet, zod, express-rate-limit, prisma or knex. On a different stack the agent carries the idea over, but you swap the calls yourself. The skill text cuts off inside the validation section, so past A04 the examples may run thin.
What it helps with
- stop one user from reading another user's record by ID
- replace string concatenation in a SQL query
- hash passwords instead of storing them in plain text
- cap failed login attempts
- validate input before it reaches the database
Example prompts for the agent
- check this route for broken access control and tell me what's wrong
- rewrite the users query so it can't be SQL injected
- add rate limiting to /api/auth and validate the fields with zod
How to install owasp-security
1Skills CLI (Vercel)
npx skills add hoodini/ai-agents-skills --skill owasp-security -a claude-code2Manually: put the files in place
~/.claude/skills/owasp-security/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/owasp-security/
1Skills CLI (Vercel)
npx skills add hoodini/ai-agents-skills --skill owasp-security -a codex2Manually: put the files in place
.agents/skills/owasp-security/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add hoodini/ai-agents-skills --skill owasp-security -a cursor2Manually: put the files in place
.cursor/skills/owasp-security/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install hoodini/ai-agents-skills owasp-security2Manually: put the files in place
.github/skills/owasp-security/SKILL.md1Skills CLI (Vercel)
npx skills add hoodini/ai-agents-skills --skill owasp-security -a gemini-cli2Platform CLI
gemini skills install https://github.com/hoodini/ai-agents-skills --path skills/owasp-securityManually: put the files in place
.devin/skills/owasp-security/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add hoodini/ai-agents-skills --skill owasp-security -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about owasp-security
How do I install owasp-security in Claude?
Run npx skills add hoodini/ai-agents-skills --skill owasp-security -a claude-code. The skill lands at ~/.claude/skills/owasp-security/SKILL.md.
What does the owasp-security skill do?
It gives the agent an OWASP Top 10 breakdown with code samples: authorization checks, password hashing, parameterized queries, input validation, rate limits and security headers.
Which stack do the examples use?
They are TypeScript and rely on bcrypt, helmet, zod, express-rate-limit, prisma and knex. On another stack the principle holds, but you replace the library calls.
Similar skills
Everything for Security →owasp-security by other authors comes first.
