goldziher - Broken Access Control — enforce authorization checks on every request, deny by default.
- Cryptographic Failures — use strong standard algorithms, never roll your own crypto.
- Injection — parameterize all queries, sanitize and validate all inputs.
- Insecure Design — threat model early, validate business logic at every layer.
- Security Misconfiguration — harden defaults, disable unnecessary features and endpoints.
- Vulnerable Components — keep dependencies updated, audit regularly with language-specific tools.
- Authentication Failures — require MFA, enforce strong passwords, implement rate limiting.
- Data Integrity Failures — verify software updates, use signed artifacts and checksums.
- Logging Failures — log all security events with context, protect log data from tampering.
- SSRF — validate and allowlist URLs, restrict outbound network requests.
Owasp Quick Reference
OWASP Top 10 quick reference: the ten most critical web application security risks (access control, crypto, injection, insecure design, misconfiguration, vulnerable components, auth, integrity, logging, SSRF) each with a one-line mitigation. Load when reviewing code or designs for security vulnerabilities or threat modeling.
Owasp Quick Reference by goldziher · 1437a20
npx skillmds@latest add goldziher/owasp-quick-reference File contents
---name: owasp-quick-referencedescription: OWASP Top 10 quick reference: the ten most critical web application security risks (access control, crypto, injection, insecure design, misconfiguration, vulnerable components, auth, integrity, logging, SSRF) each with a one-line mitigation. Load when reviewing code or designs for security vulnerabilities or threat modeling.---1. **Broken Access Control** — enforce authorization checks on every request, deny by default.2. **Cryptographic Failures** — use strong standard algorithms, never roll your own crypto.3. **Injection** — parameterize all queries, sanitize and validate all inputs.4. **Insecure Design** — threat model early, validate business logic at every layer.5. **Security Misconfiguration** — harden defaults, disable unnecessary features and endpoints.6. **Vulnerable Components** — keep dependencies updated, audit regularly with language-specific tools.7. **Authentication Failures** — require MFA, enforce strong passwords, implement rate limiting.8. **Data Integrity Failures** — verify software updates, use signed artifacts and checksums.9. **Logging Failures** — log all security events with context, protect log data from tampering.10. **SSRF** — validate and allowlist URLs, restrict outbound network requests.
goldziher/ai-rulez/tree/main/internal/builtins/universal/security/skills/owasp-quick-reference commit 1437a203d2
Frequently asked questions
Run npx skillmds@latest add goldziher/owasp-quick-reference in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
OWASP Top 10 quick reference: the ten most critical web application security risks (access control, crypto, injection, insecure design, misconfiguration, vulnerable components, auth, integrity, logging, SSRF) each with a one-line mitigation. Load when reviewing code or designs for security vulnerabilities or threat modeling. It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
goldziher (@goldziher) published this skill. Their other Agent Skills are listed on their SkillMD profile.