# Owasp Security

Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for...

- Repository: https://github.com/davila7/claude-code-templates (33041 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add davila7/claude-code-templates --skill owasp-security -g -a claude-code -y`
Codex: `npx skills add davila7/claude-code-templates --skill owasp-security -g -a codex -y`
Cursor: `npx skills add davila7/claude-code-templates --skill owasp-security -g -a cursor -y`
Gemini CLI: `npx skills add davila7/claude-code-templates --skill owasp-security -g -a gemini-cli -y`

## Description

Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the Agentic Applications 2026 edition for AI/LLM. Use for security reviews, vulnerability audits, secure auth/crypto/access-control implementation, Kubernetes manifest hardening, and LLM/agent prompt-injection defense - including indirect requests like "is this login flow secure?", "review this endpoint", or "audit my pod spec".

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Comprehensive OWASP Security Skills

A developer-focused security reference covering six OWASP standards for securing web applications, APIs, mobile apps, containers, and AI/LLM systems. Each section provides concise detection guidance, key requirements, and mitigation strategies.

## Quick Navigation

1. [OWASP Top 10 (2021)](#section-1-owasp-top-10-2021)
2. [OWASP ASVS 5.0](#section-2-owasp-asvs-50-application-security-verification-standard)
3. [OWASP MASVS v2.1.0](#section-3-owasp-masvs-v210-mobile-security)
4. [OWASP API Security Top 10](#section-4-owasp-api-security-top-10-2023)
5. [OWASP Kubernetes Top 10](#section-5-owasp-kubernetes-top-10-2022)
6. [OWASP Agentic Applications 2026](#section-6-owasp-agentic-applications-2026)

---

## Section 1: OWASP Top 10 (2021)

The OWASP Top 10 represents the most critical security risks in web applications.

### A01: Broken Access Control
**Detection:** URLs with direct ID references (`/user/1234/orders`); client-side only enforcement; missing authorization checks.
**Mitigation:** Enforce server-side authorization for every sensitive operation; verify user ownership of resources; implement default-deny principle.
**Example:**
```javascript
// INSECURE: No authorization check
app.get('/users/:id/orders', (req, res) => {
  const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id);
  res.json(orders);
});
// SECURE: Authorization check
app.get('/users/:id/orders', (req, res) => {
  if (req.user.id !== parseInt(req.params.id)) return res.status(403).json({error: 'Forbidden'});
  const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id);
  res.json(orders);
});
```
**Checklist:** ☐ Authorization on server for all sensitive ops ☐ Default-deny policy ☐ No ID-based obscurity ☐ Whitelist allowed fields

---

The rest: https://github.com/davila7/claude-code-templates/blob/HEAD/.claude-plugin/skills/owasp-security/SKILL.md