# owasp-security

A skill that hands your agent the OWASP Top 10 playbook: access control, injection, crypto, misconfig. Useful while writing auth or touching an API.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3000 installs · ★ 291
- Author: hoodini
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/hoodini/ai-agents-skills/tree/HEAD/skills/owasp-security/SKILL.md
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/skills/owasp-security

## What it does

The skill loads a reference on OWASP Top 10 (2021) into the agent's context — a table of ten categories with their countermeasures, plus code samples under each. Bad and good versions sit side by side, so the agent can see the difference instead of copying an old pattern into a new file.

Covered in the samples: ownership and role checks with RBAC, password hashing through bcrypt, aes-256-gcm encryption, helmet headers, parameterized queries instead of string building, zod input validation, request rate limits, and shell injection avoided with `execFile`. Everything is TypeScript.

The code leans on named libraries — `bcrypt`, `helmet`, `zod`, `express-rate-limit`, `prisma` or `knex`. On a different stack the agent carries the idea over, but you swap the calls yourself. The skill text cuts off inside the validation section, so past A04 the examples may run thin.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add hoodini/ai-agents-skills --skill owasp-security -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/owasp-security/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/owasp-security/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add hoodini/ai-agents-skills --skill owasp-security -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/owasp-security/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add hoodini/ai-agents-skills --skill owasp-security -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/owasp-security/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install hoodini/ai-agents-skills owasp-security
```

2. **Manually: put the files in place**
- File: `.github/skills/owasp-security/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add hoodini/ai-agents-skills --skill owasp-security -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/hoodini/ai-agents-skills --path skills/owasp-security
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/owasp-security/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add hoodini/ai-agents-skills --skill owasp-security -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/hoodini/ai-agents-skills/tree/HEAD/skills/owasp-security/SKILL.md

## When to use it
- stop one user from reading another user's record by ID
- replace string concatenation in a SQL query
- hash passwords instead of storing them in plain text
- cap failed login attempts
- validate input before it reaches the database

## Example prompts
- check this route for broken access control and tell me what's wrong
- rewrite the users query so it can't be SQL injected
- add rate limiting to /api/auth and validate the fields with zod

## Similar
- [owasp-security-check](https://affpapa.org/en/nevibecode/skills/owasp-security-check.md) — skill · 1700 installs
- [security-review](https://affpapa.org/en/nevibecode/skills/getsentry-security-review.md) — skill · 21300 installs
- [django-security](https://affpapa.org/en/nevibecode/skills/django-security.md) — skill · 5000 installs
- [security-auditor](https://affpapa.org/en/nevibecode/skills/ovachiever-security-auditor.md) — skill · 780 installs
- [Python Security Vulnerability Auditor (OWASP-Mapped & Production-Hardened)](https://affpapa.org/en/nevibecode/prompts/python-security-vulnerability-auditor-owasp-mapped-production-hardened.md) — prompt · ★ 174597
- [security-patterns](https://affpapa.org/en/nevibecode/skills/security-patterns.md) — skill · 731 installs

## Other versions with the same name
- [owasp-security · agamm](https://affpapa.org/en/nevibecode/skills/agamm-owasp-security.md) — 2400 installs

From the same set: [hoodini/ai-agents-skills](https://affpapa.org/en/nevibecode/by/hoodini/ai-agents-skills.md) — 5 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md