Skip to main content
affpapa.org
RU EN
skill CX Codex

web-security-review — Claude Code skill: what it does, how to install

Audits web applications against OWASP Top 10 (2021) risks and produces a prioritized remediation roadmap. Useful for reviewing server code, framework setups, and web configurations.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add OWASP/secure-agent-playbook --skill web-security-review -a claude-code
Open on GitHub

What web-security-review does

This skill audits web applications following the procedure in plays/owasp-top10-web-review.md. The agent starts by mapping frameworks and trust boundaries. Next, it evaluates the code against OWASP Top 10 risks, focusing on access control and injection flaws. Every step follows explicit guidance.

The procedure includes targeted checks for frameworks like Express and Django. It also reviews configuration files for Nginx or Apache. Server configuration checks require actual configuration files, so the analysis remains incomplete if deployment manifests are missing.

The final output delivers a 10-category risk matrix and a prioritized remediation roadmap. Individual findings use templates/finding.md. The review also highlights positive security controls already in place.

What it helps with

  • audit server-side code against OWASP Top 10 risks
  • detect broken access control and IDOR flaws
  • review Nginx and Apache server configurations
  • generate a risk matrix with a prioritized remediation roadmap

Example prompts for the agent

  • Run a web security review on this codebase following the OWASP Top 10 playbook
  • Audit our Express backend and Nginx configs for OWASP Top 10 vulnerabilities
  • Evaluate authentication and access control using web-security-review

How to install web-security-review

1Skills CLI (Vercel)

npx skills add OWASP/secure-agent-playbook --skill web-security-review -a claude-code

2Manually: put the files in place

~/.claude/skills/web-security-review/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/web-security-review/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about web-security-review

How do I install web-security-review in Claude Code?

Run npx skills add OWASP/secure-agent-playbook --skill web-security-review -a claude-code. This installs the skill directly into your Claude Code environment.

What does web-security-review do?

It guides an agent through a step-by-step audit of web applications against all OWASP Top 10 (2021) risk categories. The process outputs an application overview, a risk matrix, and remediation guidance.

Which frameworks does web-security-review support?

It includes specialized checks for React, Angular, Vue, Express, Django, Flask, Rails, Spring, ASP.NET, and Laravel. It also inspects Nginx and Apache web server configurations.

Source text

SKILL.md · CC-BY-4.0 
---
name: web-security-review
description: Review web applications against the OWASP Top 10 for Web Applications (2021). Use when auditing web apps, reviewing server-side code, or assessing web frameworks for the classic OWASP Top 10 risks including injection, broken auth, and XSS.
license: CC-BY-4.0
---

# Web Security Review (OWASP Top 10)

Review web applications against all 10 OWASP Top 10 risks by following the full procedure in `plays/owasp-top10-web-review.md`.

## Steps

1. **Application Mapping** — Identify framework/language, deployment model (monolith/microservices), trust boundaries (internet/internal/local), data sensitivity (PII, financial, health), and authentication mechanisms.

2. **Assess Each OWASP Top 10 Risk**:
   - **A01 Broken Access Control** — Missing authz checks, IDOR, privilege escalation, path traversal, CORS misconfigurations
   - **A02 Cryptographic Failures** — Weak algorithms, missing TLS, hardcoded keys, improper key management, cleartext storage
   - **A03 Injection** — SQLi, NoSQLi, OS command injection, LDAP injection, XSS, SSTI, XPath injection
   - **A04 Insecure Design** — Missing security requirements, business logic flaws, insecure workflows, threat modeling gaps
   - **A05 Security Misconfiguration** — Default configs, verbose errors, missing headers, unnecessary features, outdated components
   - **A06 Vulnerable Components** — Unpatched libraries, unsupported dependencies, lack of inventory, missing SBOM
   - **A07 Identification & Auth Failures** — Weak passwords, session issues, MFA gaps, credential stuffing, brute force
   - **A08 Software & Data Integrity Failures** — Insecure deserialization, unsigned updates, CI/CD attacks, dependency confusion
   - **A09 Security Logging & Monitoring Failures** — Missing audit logs, insufficient monitoring, no incident response capability
   - **A10 Server-Side Request Forgery (SSRF)** — Unvalidated URL parameters, internal service access, cloud metadata endpoints

3. **Framework-Specific Analysis** — Apply checks for detected framework (React, Angular, Vue, Express, Django, Flask, Rails, Spring, ASP.NET, Laravel).

4. **Configuration Review** — Examine web server configs (nginx, Apache), application configs, and deployment manifests for security settings.

## Output

Application overview, risk matrix for all 10 categories with severity/status, detailed findings using `templates/finding.md`, positive controls observed, and prioritized remediation roadmap.

## OWASP References

- OWASP Top 10 for Web Applications (2021)
- OWASP ASVS v5.0 — Application Security Verification Standard
- OWASP Testing Guide (WSTG)
- OWASP Cheat Sheet Series

© OWASP · CC-BY-4.0 · OWASP/secure-agent-playbook

Similar skills

All skills for Security →
typescript-security-review giuseppe-trisciuoglio Reviews TypeScript and Node.js codebases for OWASP Top 10 vulnerabilities, leaked secrets, and authentication bugs. Useful before production releases in Express, NestJS, or Next.js apps. CX Codex +1 3,900installs mcp-implementation-security-review official github Audits MCP server and client code against baseline controls, RCE vectors, and the OWASP MCP Top 10, producing file and line evidence. 49installs security-review getsentry Finds injections, XSS, authorization flaws, and other vulnerabilities in code. Reports only high-confidence findings. CX Codex +1 21,300installs code-review-security security-team A skill that walks pull requests and auth code through the OWASP Top 10 checklist and writes findings to security-review.md. CX Codex +1 438installs performing-security-headers-audit mahipal Audits HTTP security headers including CSP, HSTS, and cookie flags. It detects missing browser protections and configuration flaws on web endpoints. CX Codex +1 359installs owasp-security hoodini A skill that hands your agent the OWASP Top 10 playbook: access control, injection, crypto, misconfig. Useful while writing auth or touching an API. CX Codex +1 3,000installs

From the same set4

api-security-review This skill runs an API through the OWASP API Security Top 10 (2023), covering auth, BOLA, SSRF and gateway config. Useful before a release or when auditing someone else's service. CX Codex +1 503installs code-review-security A skill that reviews code for vulnerabilities against OWASP Top 10 and ASVS, then reports findings with attack scenarios and fixed snippets. CX Codex +1 402installs secrets-scan Scans source and config files for hardcoded credentials, API keys and tokens, whether you are reviewing before a merge or auditing a repo. CX Codex +1 337installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor