owasp-security SKILL.md skillA

owasp-security from khaledsaeed18/dotclaude is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

mdr add khaledsaeed18/dotclaude/owasp-security@git:20260921.4ccfb75

Pins git:20260921.4ccfb75 in mdr.lock. Pin the fingerprint instead.

Audit grade

A, 17 of 17 checks passed

Kind

SKILL.md skill

Repository

khaledsaeed18/dotclaude

Path

skills/security/owasp-security/SKILL.md

Versions recorded

3

Latest version

git:20260921.4ccfb75, committed Sep 21, 2026

First version recorded

Jun 10, 2026

Size

7,046 bytes

Repository stars

5

License

MIT

Review code being written or modified against the OWASP Top 10:2025 and ASVS secure-coding requirements, in any language or stack, catching vulnerability classes before they ship. Use when writing auth logic, handling user input, adding API endpoints, choosing cryptography, processing uploads, or touching any trust boundary. Complements secret-scan and dependency-audit with line-level review.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

Check code against the vulnerability classes most likely to produce real incidents. This is a line-level review of code being written or changed, not a full codebase sweep. Read the changed code and its immediate context (callers, middleware, schema) before forming any finding. Report only what can be demonstrated from the code - not what might theoretically apply.

## Injection (OWASP A03)

Any place where user-controlled data flows into an interpreter is a potential injection point. Check every such flow:

- **SQL and NoSQL:** are all parameters bound via a prepared statement or parameterized query? Any string concatenation or template literal that includes user input in a query is a finding.
- **Command execution:** `exec`, `spawn`, `system`, `popen` - is any argument derived from user input? Shell metacharacters must never reach these functions from user data.
- **Path traversal:** file system operations on paths that include user input must resolve and validate the final path against an allowed base directory. `path.join(base, userInput)` is not sufficient without checking the result starts with the allowed base.
…

Read the whole file at its exact version.

How to install

mdr add khaledsaeed18/dotclaude/owasp-security@sha256:7c9ea18d7d89c50d

[![mdr](https://markdownregistry.com/badge/art_52dlaydjgneyn67t.svg)](https://markdownregistry.com/a/art_52dlaydjgneyn67t)

Versions

The registry has recorded 3 versions of this file, between Jun 10, 2026 and Sep 21, 2026, about one every 52 days.

Audit of the latest version

Source

API

GET https://markdownregistry.com/api/v1/artifacts/art_52dlaydjgneyn67t
GET https://markdownregistry.com/api/v1/resolve?ref=khaledsaeed18/dotclaude/owasp-security
GET https://markdownregistry.com/api/v1/blob/7c9ea18d7d89c50dd968a0123d15a86e21d6c17eebdd3ef81ce9df96eb0c426c

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from khaledsaeed18/dotclaude

Every file in khaledsaeed18/dotclaude

Other files named owasp-security

Browse by kind, by grade A, or by owner.