# Owasp Security

> OWASP Security Skill Framework for Enclave AI

- Skill: `nomarj/owasp-security` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add nomarj/owasp-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nomarj/owasp-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: nomarj (https://skillmd.com/u/nomarj)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nomarj/owasp-security

---

# OWASP Security Skill Framework for Enclave AI

## Overview

Comprehensive OWASP security knowledge base and automation framework for the Enclave AI platform. Provides specialized security expertise for air-gap environments, OWASP Top 10 compliance, and enterprise security requirements.

## Specialized Security Agents

### Core OWASP Specialists

1. **owasp-injection-specialist** - A03 Injection vulnerabilities
   - SQL injection prevention and remediation
   - Command injection security for air-gap environments
   - NoSQL injection protection for DynamoDB
   - XSS prevention in React components
   - Code injection via eval/Function detection

2. **owasp-auth-specialist** - A07 Authentication failures
   - JWT security implementation
   - OAuth2/OIDC integration
   - Session management for air-gap environments
   - Multi-factor authentication
   - Authentication bypass prevention

3. **owasp-access-control-specialist** - A01 Broken access control
   - Role-based access control (RBAC) implementation
   - Workspace isolation for multi-tenant security
   - IAM policy validation
   - Privilege escalation prevention
   - Administrative control protection

4. **owasp-crypto-specialist** - A02 Cryptographic failures
   - AWS KMS integration for air-gap environments
   - TLS/SSL configuration
   - Secure random number generation
   - Password hashing best practices
   - Secrets management and rotation

5. **owasp-data-specialist** - A09 Security logging and monitoring
   - Comprehensive audit logging
   - Security event detection and correlation
   - Log integrity and tamper protection
   - Compliance monitoring (SOC2, GDPR, HIPAA)
   - Incident response automation

## Security Automation Commands

### Primary Commands

1. **owasp-scan** - Comprehensive vulnerability scanning
   - Full OWASP Top 10 analysis
   - Air-gap compatible security validation
   - Integration with Sigil scanner
   - Compliance reporting (SOC2, GDPR)
   - Executive summary generation

2. **security-training** - Automated security education
   - Interactive OWASP training modules
   - Hands-on vulnerability labs
   - Air-gap security best practices
   - TDD security workflow training
   - Certification and progress tracking

3. **vuln-fix** - Automated vulnerability remediation
   - Guided security fixes
   - Critical issue prioritization
   - Air-gap compatible solutions
   - Comprehensive validation testing
   - Continuous monitoring setup

## Knowledge Base Structure

### Core Security Patterns

#### Air-Gap Security Requirements
- Network isolation validation
- Container security boundaries
- PrivateLink endpoint configuration
- Zero external dependency verification
- VPC security group management

#### OWASP Top 10 Compliance
- A01: Broken Access Control
- A02: Cryptographic Failures  
- A03: Injection
- A04: Insecure Design
- A05: Security Misconfiguration
- A06: Vulnerable and Outdated Components
- A07: Identification and Authentication Failures
- A08: Software and Data Integrity Failures
- A09: Security Logging and Monitoring Failures
- A10: Server-Side Request Forgery (SSRF)

#### Enterprise Compliance
- SOC2 Type II requirements
- GDPR data protection standards
- HIPAA healthcare security
- PCI-DSS payment security
- ISO 27001 information security

## Usage Patterns

### Proactive Security Scanning
```bash
# Daily security validation
/owasp-scan --comprehensive --air-gap

# Pre-deployment security check
/owasp-scan --critical-only --block-on-failure

# Compliance audit
/owasp-scan --compliance SOC2 --generate-report
```

### Reactive Vulnerability Management
```bash
# Emergency security remediation
/vuln-fix --severity critical --immediate

# Guided security training after incidents
/security-training --focus authentication --post-incident

# Comprehensive security assessment
/owasp-scan --full-assessment --executive-summary
```

### Continuous Security Improvement
```bash
# Weekly security training
/security-training --role developer --weekly-module

# Monthly security assessment
/owasp-scan --monthly-review --trend-analysis

# Quarterly compliance audit
/owasp-scan --compliance-full --quarterly-report
```

## Integration Points

### Development Workflow
- Pre-commit security hooks
- CI/CD pipeline integration
- Pull request security reviews
- Automated remediation suggestions

### Monitoring and Alerting
- Real-time security event detection
- Automated incident response
- Compliance violation alerts
- Executive security reporting

### Training and Education
- Role-based security training tracks
- Hands-on vulnerability laboratories
- Certification programs
- Progress tracking and assessment

## Air-Gap Environment Considerations

### Offline Security Validation
- No external dependency scanning
- Local vulnerability databases
- Container-based security tools
- Internal certificate management

### Network Isolation
- VPC-only communication patterns
- PrivateLink endpoint validation
- Container network segmentation
- Internal DNS resolution

### Data Protection
- KMS encryption for all data at rest
- TLS 1.3 for data in transit
- Workspace-based data isolation
- Audit trail immutability

## Compliance Frameworks

### SOC2 Type II Controls
- CC6.1: Logical and physical access controls
- CC6.2: Transmission and disposal of information
- CC6.3: Network communications protection
- CC6.6: Vulnerability management
- CC6.7: System monitoring

### GDPR Requirements
- Article 25: Data protection by design and default
- Article 32: Security of processing
- Article 33: Notification of data breach
- Article 35: Data protection impact assessment

### HIPAA Safeguards
- Administrative safeguards (164.308)
- Physical safeguards (164.310)
- Technical safeguards (164.312)
- Organizational requirements (164.314)

## Security Metrics and KPIs

### Risk Assessment
- Overall security posture score (0-50 scale)
- Critical vulnerability count
- Mean time to remediation (MTTR)
- Security debt accumulation

### Compliance Tracking
- Control effectiveness percentages
- Audit readiness scores
- Compliance gap analysis
- Regulatory requirement coverage

### Training Effectiveness
- Developer security knowledge scores
- Training completion rates
- Incident reduction metrics
- Security-first development adoption

## Continuous Improvement

### Learning from Incidents
- Post-incident security analysis
- Root cause identification
- Process improvement recommendations
- Prevention strategy updates

### Industry Best Practices
- OWASP guideline updates
- Security framework evolution
- Threat landscape monitoring
- Emerging vulnerability tracking

### Tool and Process Enhancement
- Security automation improvements
- Agent capability expansion
- Training program refinement
- Compliance framework updates

This skill framework provides comprehensive OWASP security expertise specifically tailored for the Enclave AI platform's unique air-gap and enterprise requirements.