owasp-security

82 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By agamm/claude-code-owasp (GitHub) · security · 435 stars · scanned at commit 1ae29cb

Reviews code for security vulnerabilities and guides secure implementation using OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications (2026), and the OWASP Top 10 for Agentic Applications (2026). Use when reviewing code or a diff for security issues, implementing authentication, authorization, sessions, or cryptography, handling untrusted input, files, or URLs, hardening config, dependencies, or CI, or building LLM and AI agent features.

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

The author does not mention this.

Found in 5 places.

.claude/skills/owasp-security/reference/config-and-supply-chain.md, line 81- `npm install` / `pip install -r` without a lockfile step (see A03 below)
.claude/skills/owasp-security/reference/config-and-supply-chain.md, line 83- `curl ... | sh` in a build step - unverified remote code at build time
.claude/skills/owasp-security/reference/config-and-supply-chain.md, line 232| pip | `pip install -r requirements.txt` without hashes | `pip install --require-hashes -r requirements.txt` (every entry pinned `==` with `--hash`) |

Show 2 more

.claude/skills/owasp-security/reference/config-and-supply-chain.md, line 266- `pip install --extra-index-url` - pip picks the highest version across **all** indexes; use
.claude/skills/owasp-security/reference/config-and-supply-chain.md, line 285`pip install --only-binary :all:` to avoid arbitrary `setup.py` execution, and running installs

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 4 places.

.claude/skills/owasp-security/reference/languages.md, line 88**Watch for:** `pickle`, `yaml.load` without `SafeLoader`, `eval()`, `exec()`, `os.system()`,
.claude/skills/owasp-security/reference/languages.md, line 89`subprocess` with `shell=True`, user-controlled format templates, `jinja2.Template(user_input)`
.claude/skills/owasp-security/reference/owasp-report.md, line 230os.system(f"convert {filename} output.png")

Show 1 more

.claude/skills/owasp-security/reference/owasp-report.md, line 233subprocess.run(["convert", filename, "output.png"], shell=False)

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'owasp-security' ] || [ -L ~/.agents/skills/'owasp-security' ]; then echo 'A skill folder named owasp-security already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/agamm/claude-code-owasp' "$d" && git -C "$d" checkout --quiet '1ae29cb22518560e3625d77f2ae64f61647d9201' -- '.claude/skills/owasp-security' && mkdir -p ~/.agents/skills && cp -R "$d"/'.claude/skills/owasp-security' ~/.agents/skills/'owasp-security' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'owasp-security' ~/.claude/skills/'owasp-security' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for agamm/claude-code-owasp shows the score of its lowest-scoring skill.

SkillTrust badge for agamm/claude-code-owasp

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/agamm/claude-code-owasp.svg)](https://zalavijaysinh.github.io/skilltrust/repos/agamm/claude-code-owasp/)

Score history

Date	Version	Score
2026-11-07	`1ae29cb`	82