OWASP
- 40 skills
- 0 followers
- 16 hours ago last updated
- ▌ Securability · owaspWrite code that stays defensible as threats and requirements change. Use for any application code - features, endpoints, input handling, data access, auth, error handling, state, concurrency - even when security is not explicitly requested.
- ▌ Securable Code · owasp bundleDeep dive into the FIASSE Securable Software Engineering Model (SSEM) for context-heavy, architecturally complex code work - designing or reviewing trust boundaries, authentication or authorization systems, multi-service data flows, dependency architecture, or any change where the securability implications are non-obvious and worth reading the source framework sections for. Not for routine or simple changes; use the lightweight `securability` skill for those. Routes to the specific framework section the code at hand needs.
- ▌ Rad Tm · owasp bundlePerform Rapid Developer-driven Threat Modeling (RaD-TM) on a software feature — a lightweight, six-stage method that turns a feature description, user story, design doc, API spec, or source/infrastructure code into a complete threat model: data-flow model, trust boundaries, a threat list, control mapping, severity evaluation, and a ready-to-file security backlog. Use this skill whenever the user wants to threat model a feature or system, run a security design review, identify security threats and controls, find attack surface or trust boundaries, build or update a threat model, or generate security backlog items for something they are designing or building — even if they never say "RaD-TM", "STRIDE", or "threat model" by name, and even if they just describe a feature and ask "what could go wrong here, security-wise?". Especially relevant for shift-left, feature-level reviews. Threat identification is grounded in expert-curated Threat Templates so output stays consistent and the model never invents threats.
- ▌ Rad Tm Templates · owasp bundleAuthor, review, version, and maintain RaD-TM Threat Templates — the expert-curated lists of threats and pre-approved controls that ground Rapid Developer-driven Threat Modeling and keep its output consistent. Use this skill whenever someone (typically a security engineer or champion) wants to create a new threat template, derive one from a compliance standard or framework (PCI DSS, HIPAA, GDPR, NIST, OWASP, STRIDE) or a cloud/deployment context (AWS, Azure, GCP), review or tighten an existing template, add or retire threats, bump a template version, or set up template governance — even if they don't say "template" and just ask to "turn this standard into a developer threat checklist", "curate the threats our devs should check for X", or "what should be on our AWS threat list". This is the security-expert authoring counterpart to the per-feature rad-tm modeling skill; that skill consumes the templates this one produces.
- ▌ Offensive Idor · owaspInsecure Direct Object Reference (IDOR) testing skill focused on Azure resource identifiers and API endpoints. Covers GUID enumeration, horizontal/vertical privilege escalation, and Azure-specific object reference vulnerabilities.
- ▌ Offensive Sqli · owaspSQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, and blind SQLi with Azure SQL specific attack paths. Use when performing web application SQL injection testing, database enumeration, or assessing injection vectors in APIs.
- ▌ Offensive Ssrf · owaspServer-Side Request Forgery (SSRF) testing skill with focus on Azure metadata services and internal network pivots. Covers discovery, bypass techniques, and Azure-specific exploitation (IMDS, Managed Identities).
- ▌ Offensive Cloud · owaspAzure-specific offensive security testing methodology. Covers credential harvesting (IMDS, managed identities), enumeration, privilege escalation, and data exfiltration within Azure subscriptions and Entra ID tenants.
- ▌ Offensive Waf Bypass · owaspWAF bypass techniques checklist for Azure Front Door and Application Gateway. Covers encoding bypass, header manipulation, and Azure-specific evasion strategies.
- ▌ Offensive Active Directory · owaspOffensive methodology for Hybrid Active Directory and Entra ID (Azure AD). Covers pivots from on-premises to cloud (AAD Connect, Golden SAML) and cloud-to-on-prem (DCSync).
- ▌ Post Quantum Cryptography Azure · owaspIdentifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.
- ▌ Building Cloud Siem With Sentinel · owaspDeploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.
- ▌ Auditing Cloud With Cis Benchmarks · owaspConduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.
- ▌ Analyzing Cloud Storage Access Patterns · owaspDetect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.
- ▌ Analyzing Azure Activity Logs For Threats · owaspQueries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.
- ▌ Auditing Azure Active Directory Configuration · owaspAuditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.
- ▌ Building Identity Governance Lifecycle Process · owaspBuilds comprehensive identity governance and lifecycle management processes in Azure Entra ID, including JML (Joiner-Mover-Leaver) automation and periodic access reviews.
- ▌ Building Identity Federation With Saml Azure Ad · owaspEstablish SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD) for seamless cross-domain authentication and SSO.
- ▌ Your Skill Name · owaspReplace with a clear description of what this skill does and when Claude should use it.
- ▌ AI Security Verification · owaspComprehensive AI security verification using OWASP AI Security Verification Standard (AISVS) framework. Provides structured checklist to verify security and ethical considerations across 13 categories of AI-driven applications, from training data governance to human oversight.
- ▌ Multi Agentic Threat Model · owaspComprehensive threat modeling for multi-agent systems using CSA MAESTRO 7-layer framework and OWASP Multi-Agentic System Threat Modeling Guide v1.0. Systematically analyzes threats across all architectural layers from foundation models to agent ecosystems.
- ▌ Sca Audit · owaspScan project dependencies for known vulnerabilities (CVEs). Use when reviewing dependency files (package.json, requirements.txt, go.mod, pom.xml, Gemfile, Cargo.toml, etc.), triaging Dependabot/Renovate alerts, or performing pre-deployment security checks.
- ▌ Secrets Scan · owaspDetect hardcoded credentials, API keys, tokens, and secrets in source code and configuration files. Use when reviewing code for leaked secrets before commit/merge, auditing a repository for credential exposure, or setting up secret detection.
- ▌ LLM Risk Assess · owaspComprehensive LLM security assessment against OWASP Top 10 for LLM Applications 2025. Use when reviewing LLM-integrated applications, RAG pipelines, chatbots, AI agents, or GenAI features. Covers prompt injection, data poisoning, supply chain, excessive agency, and more with real-world attack scenarios and testing methodologies.
- ▌ MCP Server Review · owaspSecurity review of MCP (Model Context Protocol) server implementations and configurations. Use when auditing MCP server source code, evaluating third-party MCP servers before installation, or reviewing Claude Code MCP integrations for overpermissioning, injection risks, and data exposure.
- ▌ Security Guidance · owasp bundleSecurity-first development guidance based on OWASP ASVS (Application Security Verification Standard). Use this skill automatically when planning or implementing any code that touches user input, authentication, data persistence, network communication, file I/O, cryptography, or access control. This skill ensures all generated code adheres to industry-standard security practices with explicit references to applied guidance.
- ▌ Agent Security Audit · owaspAudit AI agent configurations for security risks — excessive permissions, prompt injection surfaces, data exfiltration paths, and missing guardrails. Use when reviewing CLAUDE.md files, MCP configs, agent orchestration code, or any AI agent setup.
- ▌ Mobile Code Review · owaspSecurity-focused review of native Android and iOS mobile app source code against OWASP MASVS v2.1.0. Use when reviewing mobile codebases, mobile PR diffs, or auditing a mobile module.
- ▌ Prompt Injection Test · owaspTest LLM-integrated applications against known prompt injection techniques, evasion methods, and attack intents using the Arcanum PI Taxonomy. Use when red-teaming AI apps, validating guardrails, or deepening LLM01 (Prompt Injection) assessments.
- ▌ API Security Review · owaspComprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting, SSRF, and more with real-world attack scenarios.
- ▌ Iac Security Review · owaspSecurity review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation). Use when reviewing IaC files for misconfigurations, overpermissioning, exposed resources, missing encryption, secrets in code, and supply chain risks. Covers CIS benchmarks and cloud security best practices.
- ▌ Web Security Review · owaspReview web applications against the OWASP Top 10 for Web Applications (2021). Use when auditing web apps, reviewing server-side code, or assessing web frameworks for the classic OWASP Top 10 risks including injection, broken auth, and XSS.
- ▌ Agentic AI Risk Assess · owaspAssess agentic AI applications against the OWASP Top 10 for Agentic Applications 2026. Use when reviewing autonomous AI agents, multi-agent systems, or agentic workflows for security risks including goal hijacking, tool misuse, privilege abuse, and rogue agent behavior.
- ▌ Code Review Security · owaspSecurity-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization.
- ▌ Securability Engineering · owasp bundleGenerate, scaffold, or refactor code so it embodies FIASSE v1.0.4 SSEM qualities by default — 10 attributes, Transparency and Least-Astonishment principles, ASVS-aligned controls, defensive boundary handling. Trigger on "secure/securable/FIASSE-compliant code", "harden", "secure-by-default", "audit-ready", or security-sensitive components (auth, file upload, password reset, input validation, API endpoints, queries) — even when those words are not explicit. For requirements use prd-securability-enhancement; for review use securability-engineering-review. The full PRD→generate→review→enhance loop is opt-in via "--full-loop" or "end-to-end securable".
- ▌ Prd Securability Enhancement · owaspEnhance PRDs, feature specs, user stories, or product briefs with explicit OWASP ASVS coverage and FIASSE v1.0.4 SSEM implementation guidance — before code is written. Trigger on "harden the PRD/spec", "choose ASVS level", "map features to ASVS", "find missing security requirements", "add NFRs for security", "make these requirements securable", "security-review my product brief". For code review use securability-engineering-review; for code generation use securability-engineering.
- ▌ Securability Engineering Review · owasp bundleScore a codebase, file, or merge request against the FIASSE v1.0.4 SSEM model — 0-10 per attribute, equal-weighted pillars, evidence-backed strengths and weaknesses, prioritized recommendations, 50-item checklist appendix. Trigger on "review/score/audit securability", "SSEM scorecard", "FIASSE/SSEM compliance", "where would I start hardening this?", "is this audit-ready?", "security posture baseline" — including phrasings that don't say SSEM explicitly. For requirements use prd-securability-enhancement; for new code use securability-engineering.
- ▌ Deploy Preview · owaspDeploy the branch that is currently checked out to the shared staging preview environment and report the preview URL back to the user.
- ▌ Threat Model Review · owasp bundleReview an OWASP Threat Model Library JSON file (threat-models/**/*.json in this repo) for diagram/data-flow consistency, architecture-to-threat traceability, missing severe threats, and control coverage of critical/high threats per the OWASP Threat Modeling project's severity chart. Use when the user asks to review, audit, check, validate, or critique a threat model file, or asks "is this threat model complete/correct". Pass --fix to have the skill apply the fixable categories directly to the file.
- ▌ Mastg Assign Ids · owasp bundleAssign real MASTG IDs to draft files that use fake placeholder IDs (e.g. MASTG-KNOW-0x01, MASTG-BEST-0x56). Use when finishing a PR that introduces new MASTG components with placeholder IDs, or when asked to "fix fake IDs", "assign real IDs", or "use next available IDs". Runs next_id.py to get the correct next IDs, renames all affected files, and replaces all in-content references.