Skip to main content
affpapa.org
RU EN
skill CX Codex

owasp-top10-analysis — Claude Code skill: what it does, how to install

Guides AI through systematic web application security reviews using the OWASP Top 10 framework. Useful for pre-release security gates and vulnerability triage.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add securityskills/skills --skill owasp-top10-analysis -a claude-code
Open on GitHub

What owasp-top10-analysis does

This skill structures code inspections around the 2021 OWASP Top 10 categories. The agent tests access control, cryptographic setups, injection vectors, and logic flaws. It covers both source code and deployment configs.

Every confirmed defect receives a standardized breakdown. The resulting report details the category, technical evidence, reproduction steps, severity rating, and suggested fixes. Verified negative results are also logged to document assessment coverage.

Without build manifests or lockfiles, dependency audits against known advisories cannot produce meaningful results.

What it helps with

  • audit API routes for IDOR flaws and improper permission checks
  • inspect database queries and sorting filters for injection risks
  • detect unencrypted secrets or deprecated hashing algorithms
  • spot SSRF risks across webhook handlers and remote URL fetchers

Example prompts for the agent

  • Run an owasp-top10-analysis review across our billing and checkout controllers
  • Inspect our authentication endpoints against OWASP session management guidelines
  • Check file upload and PDF generation routines for command injection and SSRF vectors

How to install owasp-top10-analysis

1Skills CLI (Vercel)

npx skills add securityskills/skills --skill owasp-top10-analysis -a claude-code

2Manually: put the files in place

~/.claude/skills/owasp-top10-analysis/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/owasp-top10-analysis/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about owasp-top10-analysis

How do I install owasp-top10-analysis in Claude Code?

Run npx skills add securityskills/skills --skill owasp-top10-analysis -a claude-code in your terminal. Alternatively, place the file directly at ~/.claude/skills/owasp-top10-analysis/SKILL.md.

What does owasp-top10-analysis do?

It instructs your assistant to conduct methodical code reviews against all ten OWASP 2021 vulnerability classifications. The process walks through access boundaries, cryptographic hygiene, injection risks, and logging practices.

What does the security report output look like?

Each identified issue lists its risk category, reproduction path, technical proof, severity rating, and fix guidance. Categories with zero detected flaws are marked as verified negatives.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set9

stride-threat-modeling Run a structured STRIDE threat modeling workshop during system design. The skill maps trust boundaries, catalogs attack vectors per component, and generates backlog tickets. CX Codex +1 2,700installs jwt-security-review Audits JWT implementations for key confusion, weak secrets, and token lifecycle flaws. Handy when checking API authorization code. CX Codex +1 1,500installs agentic-sdlc-controls Audits development pipelines where AI agents commit, run tests, or deploy code. It maps credentials and defines hard boundaries for irreversible actions. CX Codex +1 800installs network-segmentation-review Inspects traffic boundaries across local networks, firewalls, and cloud environments. It helps engineers spot routing leaks and test zone isolation. CX Codex +1 584installs pci-dss-scoping Walks an agent through PCI DSS scoping: cardholder data flows, segmentation checks and a v4.0 requirements matrix. Built for audit prep. CX Codex +1 414installs attack-surface-recon Discovers external company assets, open database ports, leaked repository tokens, and takeover risks. Best for starting security reviews or running perimeter audits. CX Codex +1 351installs ai-change-evidence Builds an auditor-ready record for changes written by coding agents: who asked, what was requested, who approved. Useful when that code sits under SOC 2, ISO 27001 or PCI DSS. CX Codex +1 334installs active-directory-attack-paths Guides security assessments in Active Directory environments, covering privilege escalation paths from initial discovery to delegation and ACL abuse. CX Codex +1 319installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor