Common Owasp
OWASP Top 10 audit checklists for Web Applications (2021), APIs (2023), and Mobile (2024).
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-owasp -g -a claude-code -y- Repository
- HoangNguyen0403/agent-skills-standard582
- Category
- Security
- Updated
- 3d ago
- License
- MIT
- Context cost
- Lightabout 1,190 tokens
- Runs scripts
- No, instructions only
What it does
OWASP Top 10 audit checklists for Web Applications (2021), APIs (2023), and Mobile (2024). Use when performing any security review, PR review, or codebase audit touching web, mobile, or API code.
OWASP Top 10 Security Checklist
Priority: P0 (CRITICAL)
Always-Apply Rules
Apply these on every code write, not during dedicated security reviews:
- No IDOR: Filter every resource query by
owner_idortenantIdalongside any user-supplied ID.findById(params.id)without owner filter immediate P0. - No wildcard CORS: Restrict to explicit allowlisted origins, never
Access-Control-Allow-Origin: *on authenticated routes. - No full entity return: Always project to DTO, never serialize raw ORM output to API response.
- No plaintext secrets in mobile: Never store tokens in
SharedPreferences/UserDefaults, use Keychain/Keystore.
Context-Specific Checklist
Activate when: writing security-sensitive features, reviewing PRs, or doing codebase audits.
Mark each item: ✅ not affected | ⚠️ needs review | 🔴 confirmed finding.
P0 finding caps Security score at 40/100.
Apply framework-specific security skills alongside this checklist. See references/owasp-web.md, references/owasp-api.md, and references/owasp-mobile.md for full detection signals.
