agentic-owasp

84 / 100 · Low risk

Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.

By Ovid/paad (GitHub) · coding · 153 stars · scanned at commit d52c695

EXPERIMENTAL. Use when code needs a security review against the OWASP Top 10:2025 — access control, misconfiguration, supply chain, cryptography, injection, insecure design, authentication, integrity, logging and alerting, and mishandled exceptional conditions. Not for penetration testing a running system, not for infrastructure-only scanning, and not for fixing what it finds.

Works with any agent that supports SKILL.md skills.

What this skill can do

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 1 place.

plugins/paad/skills/agentic-owasp/SKILL.md, line 4365. `find . -maxdepth 4 -type d \( -name node_modules -o -name vendor -o -name dist -o -name build -o -name target -o -name coverage -o -name .git -o -name .aws

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 2 places.

plugins/paad/skills/agentic-owasp/SKILL.md, line 572| Shell / process | `exec`, `system`, `spawn`, backticks, `subprocess` with `shell=True` |
plugins/paad/skills/agentic-owasp/SKILL.md, line 1366`shell=True`, `verify=False`, `rejectUnauthorized: false`.

Connects to the internet

This is disclosed by the author in the skill's SKILL.md or README.

Found in 1 place.

plugins/paad/skills/agentic-owasp/references/paad-analyst.md, line 33`WebSearch` and `WebFetch` exist so you can check a claim against a primary source — a vendor's documentation, a standard, a changelog, an upstream issue. They

Other copies in this repository

Ovid/paad has 3 more folders with a skill named agentic-owasp. This page shows the lowest-scoring copy.

preview/paad/skills/agentic-owasp 84/100 · Low risk
kiro_and_antigravity/skills/.kiro/skills/agentic-owasp 84/100 · Low risk
kiro_and_antigravity/skills/.agent/skills/agentic-owasp 100/100 · Low risk

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'agentic-owasp' ] || [ -L ~/.agents/skills/'agentic-owasp' ]; then echo 'A skill folder named agentic-owasp already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/Ovid/paad' "$d" && git -C "$d" checkout --quiet 'd52c695ff6f76601d54cde49354f0aab66a06c0f' -- 'plugins/paad/skills/agentic-owasp' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/paad/skills/agentic-owasp' ~/.agents/skills/'agentic-owasp' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'agentic-owasp' ~/.claude/skills/'agentic-owasp' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for Ovid/paad shows the score of its lowest-scoring skill.

SkillTrust badge for Ovid/paad

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/Ovid/paad.svg)](https://zalavijaysinh.github.io/skilltrust/repos/Ovid/paad/)

Score history

Date	Version	Score
2026-11-13	`d52c695`	84
2026-11-09	`e6ebec7`	84
2026-11-07	`7e5117a`	84