Application Security Review
Use current primary guidance as a review baseline, then report only what the available evidence supports. Primary authority: official reference.
Workflow
- Define assets, actors, trust boundaries, entry points, sensitive operations, and credible abuse cases.
- Inspect architecture, code, configuration, tests, and runtime evidence for relevant controls.
- Map findings to versioned OWASP ASVS requirements where the evidence supports an exact mapping.
- Use the OWASP Top 10 only for awareness and risk framing, not as a verification checklist.
- Classify each finding by exploit preconditions, impact, likelihood, evidence, and remediation priority.
- Identify missing tests, logging, rate limits, failure behavior, secret handling, and deployment controls.
- Separate code findings from provider configuration and unobserved runtime risk.
Boundaries
- Do not claim OWASP compliance, certification, or complete coverage from this review.
- Do not run exploit payloads against systems without explicit authorization and a safe test boundary.
- Use skill-security-review for agent skills and plugins; this skill evaluates applications and services.
Output
Return Threat scope, Verified controls, Findings, Evidence gaps, Risk priority, Recommended verification, and Claim limits.
1---2name: application-security-review3description: Review application or service security against current threat evidence and verifiable control requirements. Use for read-only assessment of authentication, authorization, input handling, data protection, session, error, configuration, and abuse risks; do not use this skill to audit agent packages.4license: MIT5---67# Application Security Review89Use current primary guidance as a review baseline, then report only what the available evidence supports. Primary authority: [official reference](https://owasp.org/www-project-application-security-verification-standard/).1011## Workflow12131. Define assets, actors, trust boundaries, entry points, sensitive operations, and credible abuse cases.142. Inspect architecture, code, configuration, tests, and runtime evidence for relevant controls.153. Map findings to versioned OWASP ASVS requirements where the evidence supports an exact mapping.164. Use the OWASP Top 10 only for awareness and risk framing, not as a verification checklist.175. Classify each finding by exploit preconditions, impact, likelihood, evidence, and remediation priority.186. Identify missing tests, logging, rate limits, failure behavior, secret handling, and deployment controls.197. Separate code findings from provider configuration and unobserved runtime risk.2021## Boundaries2223- Do not claim OWASP compliance, certification, or complete coverage from this review.24- Do not run exploit payloads against systems without explicit authorization and a safe test boundary.25- Use skill-security-review for agent skills and plugins; this skill evaluates applications and services.2627## Output2829Return Threat scope, Verified controls, Findings, Evidence gaps, Risk priority, Recommended verification, and Claim limits.30
JovaniPink