# owasp-top10-analysis

Guides AI through systematic web application security reviews using the OWASP Top 10 framework. Useful for pre-release security gates and vulnerability triage.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 495 installs
- Author: securityskills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/securityskills/skills/tree/HEAD/web-appsec/owasp/owasp-top10-analysis/SKILL.md
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/skills/owasp-top10-analysis

## What it does

This skill structures code inspections around the 2021 OWASP Top 10 categories. The agent tests access control, cryptographic setups, injection vectors, and logic flaws. It covers both source code and deployment configs.

Every confirmed defect receives a standardized breakdown. The resulting report details the category, technical evidence, reproduction steps, severity rating, and suggested fixes. Verified negative results are also logged to document assessment coverage.

Without build manifests or lockfiles, dependency audits against known advisories cannot produce meaningful results.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill owasp-top10-analysis -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/owasp-top10-analysis/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/owasp-top10-analysis/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill owasp-top10-analysis -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/owasp-top10-analysis/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill owasp-top10-analysis -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/owasp-top10-analysis/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install securityskills/skills owasp-top10-analysis
```

2. **Manually: put the files in place**
- File: `.github/skills/owasp-top10-analysis/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill owasp-top10-analysis -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/securityskills/skills --path web-appsec/owasp/owasp-top10-analysis
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/owasp-top10-analysis/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill owasp-top10-analysis -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/securityskills/skills/tree/HEAD/web-appsec/owasp/owasp-top10-analysis/SKILL.md

## When to use it
- audit API routes for IDOR flaws and improper permission checks
- inspect database queries and sorting filters for injection risks
- detect unencrypted secrets or deprecated hashing algorithms
- spot SSRF risks across webhook handlers and remote URL fetchers

## Example prompts
- Run an owasp-top10-analysis review across our billing and checkout controllers
- Inspect our authentication endpoints against OWASP session management guidelines
- Check file upload and PDF generation routines for command injection and SSRF vectors

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [securityskills/skills](https://affpapa.org/en/nevibecode/by/securityskills/skills.md) — 9 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md