# Common Owasp

OWASP Top 10 audit checklists for Web Applications (2021), APIs (2023), and Mobile (2024).

- Repository: https://github.com/HoangNguyen0403/agent-skills-standard (582 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-owasp -g -a claude-code -y`
Codex: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-owasp -g -a codex -y`
Cursor: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-owasp -g -a cursor -y`
Gemini CLI: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-owasp -g -a gemini-cli -y`

## Description

OWASP Top 10 audit checklists for Web Applications (2021), APIs (2023), and Mobile (2024). Use when performing any security review, PR review, or codebase audit touching web, mobile, or API code.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# OWASP Top 10 Security Checklist

## **Priority: P0 (CRITICAL)**

## Always-Apply Rules

Apply these on **every code write**, not during dedicated security reviews:

- **No IDOR**: Filter every resource query by `owner_id` or `tenantId` alongside any user-supplied ID. `findById(params.id)` without owner filter immediate P0.
- **No wildcard CORS**: Restrict to explicit allowlisted origins, never `Access-Control-Allow-Origin: *` on authenticated routes.
- **No full entity return**: Always project to DTO, never serialize raw ORM output to API response.
- **No plaintext secrets in mobile**: Never store tokens in `SharedPreferences`/`UserDefaults`, use Keychain/Keystore.

## Context-Specific Checklist

Activate when: writing security-sensitive features, reviewing PRs, or doing codebase audits.

Mark each item: ✅ not affected | ⚠️ needs review | 🔴 confirmed finding.

**P0 finding caps Security score at 40/100.**

Apply framework-specific security skills alongside this checklist.
See [references/owasp-web.md](references/owasp-web.md), [references/owasp-api.md](references/owasp-api.md), and [references/owasp-mobile.md](references/owasp-mobile.md) for full detection signals.

### OWASP Web Application Top 10 (2021)

The rest: https://github.com/HoangNguyen0403/agent-skills-standard/blob/HEAD/.codex/skills/common/common-owasp/SKILL.md