This skill provides a structured framework for Application Security Engineers to automate security reviews. It guides the identification of vulnerabilities in authentication, authorization, and user input handling by applying established industry benchmarks.
The tool incorporates the OWASP Top 10:2025 and ASVS 5.0, while extending coverage to LLM Top 10 (2025) and Agentic AI security standards for 2026.
Follow the documented setup, then try a first task.
Installs: Single project · Claude Code
Run from: Project directory
In a terminal, copy the entire skill folder into the current project's .claude/skills directory.
npx degit agamm/claude-code-owasp/.claude/skills/owasp-security .claude/skills/owasp-security
Installs: All projects · Claude Code
In a terminal, copy the entire skill folder into the global Claude Code skills directory.
npx degit agamm/claude-code-owasp/.claude/skills/owasp-security ~/.claude/skills/owasp-security
Installs: Single project · Claude Code
Run from: Directory where claude-code-owasp will be cloned and YOUR_PROJECT is reachable
In a terminal, clone the full repository and copy the complete skill directory into the target project's Claude Code skills directory. Replace YOUR_PROJECT with the target project path.
git clone https://github.com/agamm/claude-code-owasp.git cp -r claude-code-owasp/.claude/skills/owasp-security YOUR_PROJECT/.claude/skills/
Uses owasp-security
Use the owasp-security skill to review <path-to-file-or-small-module> for security issues. Trace whether each suspected issue involves attacker-controlled input, whether the relevant sink is reachable despite existing controls, and what its blast radius is before reporting it.
Uses owasp-security
Use the owasp-security skill to assess whether the authentication implementation in <path-to-auth-code> is secure. Focus the first pass on authentication failures, password handling, session security, and any centralized middleware or framework controls that affect the result.
Uses owasp-security
Use the owasp-security skill to check the AI agent implementation in <path-to-agent-code> for OWASP agentic security risks. Return a concise first-pass review tied to the code provided.
Claude
Cursor