Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
This skill provides a structured framework for Application Security Engineers to automate vulnerability detection and auditing. It applies the OWASP Top 10:2025 and ASVS 5.0 standards to identify exploitable code, harden configurations, and secure authentication and cryptography implementations.
Beyond traditional web security, the skill includes specialized guidance for securing agentic AI and LLM features. It helps developers mitigate prompt injection and secure MCP servers using the OWASP Top 10 for LLM and Agentic Applications.
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Installs: Install the complete owasp-security skill directory in one project. · Claude Code
Before you start
npx must be available
Run from: Target project root
From the target project's root directory, run this terminal command. It copies the complete skill folder, including SKILL.md and its on-demand reference files, into the project's .claude/skills/owasp-security directory.
Installs: Clone the full claude-code-owasp repository, then copy its owasp-security skill into a selected project. · Claude Code
Before you start
Git must be available
Run this complete terminal command sequence. Replace YOUR_PROJECT with the path to the target project while keeping the placeholder text unchanged in the command shown here.
Replace <PATH_TO_FILE_OR_SMALL_DIRECTORY> with the path to one file or a small directory to review.
Provide any relevant context about authentication, authorization, deployment, or expected trust boundaries if it is not evident from the code.
Use the owasp-security skill to review the code in <PATH_TO_FILE_OR_SMALL_DIRECTORY> for security issues. Map attacker-controlled entry points and trust boundaries, trace each candidate issue from input to sink, triage candidates, and report only supported findings. Do not modify the code.
Claude