owasp-web SKILL.md skillA
owasp-web from nahid-sparktales/agent-dispatcher is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add nahid-sparktales/agent-dispatcher/owasp-web@git:20260919.a0d4f55Pins git:20260919.a0d4f55 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- nahid-sparktales/agent-dispatcher
- Path
skills/security/owasp-web/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260919.a0d4f55, committed Sep 19, 2026
- Size
- 7,745 bytes
- Repository stars
- 58
- License
- MIT
Hunt the web failure classes that actually recur — broken access control, injection, XSS by output context, SSRF, unsafe deserialization and mass assignment, session and token handling, secrets leakage, file handling — as patterns to find in this codebase. Use when writing or reviewing request handlers, queries, URL fetches, templates, uploads or auth code, or when asked to check a web app for the common vulnerability classes. Not for design-stage modeling (threat-modeling), not infrastructure…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Web failure classes These classes recur because frameworks make the unsafe version shorter to write. Finding them is reading for a pattern — untrusted input reaching somewhere that treats it as instruction — not reciting a taxonomy. A class you name without a file and a path is not a finding. ## When this fires Code that receives requests, builds queries, renders output, fetches URLs, parses serialized data, handles sessions or accepts files is being written or reviewed. Use it inside a review pass, or on its own when asked to sweep an app for the usual suspects. ## Procedure 1. **Enumerate the untrusted entry points first.** Route tables and handlers, GraphQL resolvers and their nested fields, webhook receivers, queue consumers, file uploads, CLI and admin scripts, anything parsing a header or cookie. Every class below is checked *from* these, not by browsing files alphabetically. 2. **Broken access control, before anything else.** It is the most common and the least visible to tooling. Look for a handler taking an id from the path, body or query and fetching without …
Read the whole file at its exact version.
How to install
mdr add nahid-sparktales/agent-dispatcher/owasp-web@sha256:a4c6f361238731b6The line at the top of this page pins the label git:20260919.a0d4f55, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_2ugxxaabd5y5qw6e)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 19, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (7745 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
nahid-sparktales/agent-dispatcher · 58 stars · license MIT · pushed 2026-10-24 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_2ugxxaabd5y5qw6e GET https://markdownregistry.com/api/v1/resolve?ref=nahid-sparktales/agent-dispatcher/owasp-web GET https://markdownregistry.com/api/v1/blob/a4c6f361238731b6ec992e9cd04ed8a88663d2a04669c0ad809234aabd50e363
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.