OWASP-Security-Skills

OWASP Security Skills

A Claude Code plugin with two OWASP-aligned security skills: owasp-security-audit, covering seven OWASP standards (Top 10, ASVS, MASVS, API Security, Kubernetes, LLM, and Agentic Applications — LLM and Agentic Applications are counted separately), and secure-coding-practices, a 14-domain secure coding checklist re-derived from OWASP's living sources. Together they ground security-related prompts — code reviews, auth and crypto implementation, Kubernetes manifests, LLM/agent code — in standard-aligned analysis with citations.

Install the plugin into Claude Code and any security question automatically draws on the OWASP guidance most relevant to your context. See skills/owasp-security-audit/SKILL.md and skills/secure-coding-practices/SKILL.md for the full activation triggers and workflow each skill follows, and each skill's references/ directory for the underlying standard-specific lookup docs.

What it does

• Identifies risks in code, configuration, or design across web, API, mobile, container, and AI/LLM contexts.
• Cites the relevant OWASP standard for the situation at hand.
• Recommends concrete fixes with code and configuration examples.
• Flags bypasses and edge cases attackers commonly exploit.

Coverage

Every edition and source URL below is sourced from the hardened owasp-urls.json citation files (Phases 2–3 of this project) — not re-derived here.

What this is NOT

• This is guidance and reference material, not a runtime scanner. It does not execute code, run tests, or make network requests — it audits code you paste or point it at, via inspection and pattern matching.
• The example files do not yet cover every 2025 Top 10 category. As of this release, no example demonstrates A03 Software Supply Chain Failures, A04 Insecure Design, A06 Vulnerable & Outdated Components, A08 Software or Data Integrity Failures, or A10 Mishandling of Exceptional Conditions. This table discloses that gap — it does not fill it. Authoring examples for these categories is tracked as future work.

Installation

Option 1: Claude Code plugin marketplace (recommended)

claude plugin marketplace add mfkocalar/OWASP-Security-Skills
claude plugin install owasp-security-skills@owasp-security-skills

Then confirm both skills were discovered:

claude plugin details owasp-security-skills@owasp-security-skills

This is the primary, supported install path for Claude Code.

Option 2: install.sh (alternative — symlink-based, non-plugin assistants)

For assistants without plugin/marketplace support (or for a manual, symlink-based Claude Code install), clone the repo and run the installer:

git clone https://github.com/mfkocalar/OWASP-Security-Skills.git
cd OWASP-Security-Skills
./install.sh

The installer detects your OS, symlinks the skills into the right directory, and verifies the files. To link manually instead:

# Claude (macOS)
ln -s "$PWD" ~/.claude/skills/owasp-security
# Claude (Linux)
ln -s "$PWD" ~/.local/share/claude/skills/owasp-security
# GitHub Copilot
ln -s "$PWD" ~/.copilot/skills/owasp-security

Reload or restart the assistant afterward.

Usage

Just describe what you're working on and paste the code. The skill selects the matching standard automatically.

Review this REST API endpoint for OWASP API security issues.

[paste code here]

More examples:

Repository structure

.claude-plugin/
  plugin.json                          Plugin identity manifest (canonical version source)
  marketplace.json                     Marketplace catalog listing
skills/
  owasp-security-audit/                Structured audit skill
    SKILL.md                           Frontmatter (name + description) + workflow
    references/                        Standard-specific lookup docs + owasp-urls.json
    scripts/quick_scan.py              Regex-based lead scanner
    assets/examples/                   9 vulnerable/secure code samples
  secure-coding-practices/             Secure Coding Practices skill
    SKILL.md
    references/                        Checklist, patterns, owasp-urls.json
    assets/examples/                   2 vulnerable/secure code samples
docs/
  SKILL-STRUCTURE.md                   Canonical skill-directory convention
scripts/
  check_version_drift.py               Version single-source-of-truth check
  lint_skill_md.py                      SKILL.md frontmatter linter
LICENSE
README.md
CONTRIBUTING.md
install.sh                             Alternative symlink-based installer

Examples

Examples live per-skill under each skill's assets/examples/ directory: 9 samples in skills/owasp-security-audit/assets/examples/ covering the OWASP Top 10 and related standards, plus 2 samples in skills/secure-coding-practices/assets/examples/ for secure coding practices. Each pairs a vulnerable pattern with a secure implementation and an explanation.

Paste any sample into a prompt to see the skill in action:

Review this code for security vulnerabilities according to the OWASP Top 10.

[paste example code here]

Documentation

• skills/owasp-security-audit/SKILL.md and its references/ — vulnerability descriptions, detection clues, mitigations, and checklists for the audit skill's standards.
• skills/secure-coding-practices/SKILL.md and its references/ — the 14-domain secure coding checklist and living-source crosswalk.
• docs/SKILL-STRUCTURE.md — the canonical skill-directory convention followed by both skills.
• CONTRIBUTING.md — how to contribute.

Contributing

Contributions are welcome. See CONTRIBUTING.md.

License

Released under the MIT License.