How do I install the Owasp Top10 Analysis skill?

Run npx skillmds@latest add securityskills/owasp-top10-analysis in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Owasp Top10 Analysis safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Owasp Top10 Analysis?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Owasp Top10 Analysis free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Owasp Top10 Analysis?

securityskills (@securityskills) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Owasp Top10 Analysis by securityskills

Name: Owasp Top10 Analysis
Author: securityskills

File contents

OWASP Top 10 Analysis

Work a web application category-by-category so nothing is skipped.

Checklist by Category (2021)

A01 Broken Access Control

Test IDOR: swap identifiers (user IDs, UUIDs, filenames) between two test accounts
Verify server-side enforcement on every endpoint, not just UI hiding
Try HTTP method overrides, path traversal in IDs, mass assignment on profile updates
Check forced browsing to admin routes after logout/role downgrade

A02 Cryptographic Failures

Confirm TLS 1.2+ only, HSTS present
Find plaintext protocols, hardcoded keys, weak hashes (MD5/SHA1) for passwords
Passwords hashed with bcrypt/argon2 + per-user salt; secrets not in client bundles

A03 Injection

SQL/NoSQL/ORM injection: parameterized queries verified; test in sort/filter/order params, not just search
OS command injection in file upload/filename handling, image processing, PDF generators
Header injection, template injection (SSTI) in email/render features

A04 Insecure Design

Business logic abuse: negative quantities, currency confusion, race conditions on credits/coupons
Trust-boundary violations: client-computed prices, unsigned discount tokens

A05 Security Misconfiguration

Debug modes, default credentials, verbose errors, directory listing
Unnecessary features enabled (PUT, TRACE), permissive CORS (* with credentials)

A06 Vulnerable Components

SBOM against known CVEs; flag unmanaged/EOL dependencies
Check client-side libs too (npm audit / Retire.js signals)

A07 Authentication Failures

Credential stuffing resistance (rate limiting, MFA), session fixation, weak password policy
Session tokens: rotated on login, invalidated on logout, secure/httpOnly flags
MFA bypass flows: reset, backup codes, OAuth account linking

A08 Integrity Failures

Unsigned updates/deserialization of untrusted data (pick your targets: memcached, JWT, file parsers)
CI/CD pipeline: pinned dependencies, verified provenance

A09 Logging & Monitoring

Auth events, access-control denials, and input-validation failures are logged with context
Logs don't contain passwords/tokens; alerting exists for brute force

A10 SSRF

Any URL-fetch feature (webhooks, importers, preview generators): test localhost, link-local (169.254.169.254), IPv6 equivalents, DNS rebinding
Scheme and redirect handling enforced server-side

Output

Per finding: category, evidence, reproduction, severity, fix. Note verified-negatives per category for coverage evidence.

---name: owasp-top10-analysisdescription: Systematically review a web application against the OWASP Top 10 vulnerability classes with concrete test cases per category. Use for web app assessments and security gate reviews.---# OWASP Top 10 AnalysisWork a web application category-by-category so nothing is skipped.## Checklist by Category (2021)### A01 Broken Access Control- Test IDOR: swap identifiers (user IDs, UUIDs, filenames) between two test accounts- Verify server-side enforcement on every endpoint, not just UI hiding- Try HTTP method overrides, path traversal in IDs, mass assignment on profile updates- Check forced browsing to admin routes after logout/role downgrade### A02 Cryptographic Failures- Confirm TLS 1.2+ only, HSTS present- Find plaintext protocols, hardcoded keys, weak hashes (MD5/SHA1) for passwords- Passwords hashed with bcrypt/argon2 + per-user salt; secrets not in client bundles### A03 Injection- SQL/NoSQL/ORM injection: parameterized queries verified; test in sort/filter/order params, not just search- OS command injection in file upload/filename handling, image processing, PDF generators- Header injection, template injection (SSTI) in email/render features### A04 Insecure Design- Business logic abuse: negative quantities, currency confusion, race conditions on credits/coupons- Trust-boundary violations: client-computed prices, unsigned discount tokens### A05 Security Misconfiguration- Debug modes, default credentials, verbose errors, directory listing- Unnecessary features enabled (PUT, TRACE), permissive CORS (`*` with credentials)### A06 Vulnerable Components- SBOM against known CVEs; flag unmanaged/EOL dependencies- Check client-side libs too (npm audit / Retire.js signals)### A07 Authentication Failures- Credential stuffing resistance (rate limiting, MFA), session fixation, weak password policy- Session tokens: rotated on login, invalidated on logout, secure/httpOnly flags- MFA bypass flows: reset, backup codes, OAuth account linking### A08 Integrity Failures- Unsigned updates/deserialization of untrusted data (pick your targets: memcached, JWT, file parsers)- CI/CD pipeline: pinned dependencies, verified provenance### A09 Logging & Monitoring- Auth events, access-control denials, and input-validation failures are logged with context- Logs don't contain passwords/tokens; alerting exists for brute force### A10 SSRF- Any URL-fetch feature (webhooks, importers, preview generators): test localhost, link-local (169.254.169.254), IPv6 equivalents, DNS rebinding- Scheme and redirect handling enforced server-side## OutputPer finding: category, evidence, reproduction, severity, fix. Note verified-negatives per category for coverage evidence.

Frequently asked questions

Owasp Top10 Analysis