owasp-security

67 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By davila7/claude-code-templates (GitHub) · security · 33,256 stars · scanned at commit a6e6f93

Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the Agentic Applications 2026 edition for AI/LLM. Use for security reviews, vulnerability audits, secure auth/crypto/access-control implementation, Kubernetes manifest hardening, and LLM/agent prompt-injection defense - including indirect requests like "is this login flow secure?", "review this endpoint", or…

Works with any agent that supports SKILL.md skills.

What this skill can do

Changes files outside its own folder

The author does not mention this.

Found in 2 places.

.claude-plugin/skills/owasp-security/README.md, line 39ln -s "$PWD" ~/.claude/skills/owasp-security
.claude-plugin/skills/owasp-security/skill.json, line 353"command": "ln -s /path/to/OWASP-Security-Skills ~/.claude/skills/owasp-security",

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 2 places.

.claude-plugin/skills/owasp-security/SKILL.md, line 69os.system("tar -czf " + filename + " /var/data")
.claude-plugin/skills/owasp-security/SKILL.md, line 73subprocess.run(["tar", "-czf", filename, "/var/data"], check=True)

Downloads and installs other software

The author does not mention this.

Found in 9 places.

.claude-plugin/skills/owasp-security/examples/security-misconfiguration.py, line 45RUN pip install -r requirements.txt
.claude-plugin/skills/owasp-security/examples/security-misconfiguration.py, line 213RUN pip install --no-cache-dir -r requirements.txt
CONTRIBUTING.md, line 128"command": "npx",

Show 6 more

CONTRIBUTING.md, line 247Test it with `npx claude-code-templates@latest --skill {category}/{name} --dry-run`.
CONTRIBUTING.md, line 255npx -y -p typescript@5 tsc -p tsconfig.json # must typecheck against types/claude-code.d.ts
CONTRIBUTING.md, line 442npx claude-code-templates@latest --agent your-agent --dry-run
CONTRIBUTING.md, line 443npx claude-code-templates@latest --command your-command --dry-run
CONTRIBUTING.md, line 444npx claude-code-templates@latest --mcp your-mcp --dry-run
CONTRIBUTING.md, line 450npx claude-code-templates@latest --template your-template --dry-run

Connects to the internet

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 6 places.

.claude-plugin/skills/owasp-security/examples/security-misconfiguration.py, line 235CMD python -c "import requests; requests.get('http://localhost:5000/health')"
.claude-plugin/skills/owasp-security/examples/xss.html, line 93fetch('/api/comment?id=123')
CONTRIBUTING.md, line 351curl -X POST http://localhost:3333/api/cache/clear -H "Content-Type: application/json" -d '{"type":"all"}'

Show 3 more

CONTRIBUTING.md, line 354curl http://localhost:3333/api/refresh
CONTRIBUTING.md, line 382curl -X POST http://localhost:3333/api/cache/clear -H "Content-Type: application/json" -d '{"type":"conversations"}'
CONTRIBUTING.md, line 383curl http://localhost:3333/api/refresh

Safer alternatives

Low-risk skills in the same category (security) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'owasp-security' ] || [ -L ~/.agents/skills/'owasp-security' ]; then echo 'A skill folder named owasp-security already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/davila7/claude-code-templates' "$d" && git -C "$d" checkout --quiet 'a6e6f93e9a4baaa6ff337aee5505bf5c2bae4ce6' -- '.claude-plugin/skills/owasp-security' && mkdir -p ~/.agents/skills && cp -R "$d"/'.claude-plugin/skills/owasp-security' ~/.agents/skills/'owasp-security' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'owasp-security' ~/.claude/skills/'owasp-security' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for davila7/claude-code-templates shows the score of its lowest-scoring skill.

SkillTrust badge for davila7/claude-code-templates

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/davila7/claude-code-templates.svg)](https://zalavijaysinh.github.io/skilltrust/repos/davila7/claude-code-templates/)

Score history

Date	Version	Score
2026-11-10	`a6e6f93`	67
2026-11-08	`b086f26`	67
2026-11-07	`395f30e`	57