Use this skill when the user asks for OWASP Top 10 mapping, CWE alignment, or standards-oriented reporting. The directory name stays `owasp-2025` for backward compatibility, but external reports should use official OWASP Top 10 names.
From vuln-scoutnpx claudepluginhub allsmog/vuln-scout --plugin vuln-scoutThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
Map VulnScout findings to official OWASP Top 10 category names, highlight what the plugin covers well, and keep reports aligned with widely recognized security terminology.
owasp-2025 directory name as a compatibility alias, not as proof of a future OWASP taxonomy.| OWASP Top 10 | VulnScout Coverage | Primary Skills |
|---|---|---|
| A01: Broken Access Control | Strong | business-logic, threat-modeling |
| A02: Cryptographic Failures | Strong | cryptographic-failures |
| A03: Injection | Strong | vuln-patterns, dangerous-functions, framework-patterns |
| A04: Insecure Design | Strong | business-logic, threat-modeling |
| A05: Security Misconfiguration | Strong | security-misconfiguration, framework-patterns |
| A06: Vulnerable and Outdated Components | Out of scope | (dependency and SBOM tooling) |
| A07: Identification and Authentication Failures | Moderate | vuln-patterns, business-logic |
| A08: Software and Data Integrity Failures | Moderate | vuln-patterns, sensitive-data-leakage |
| A09: Security Logging and Monitoring Failures | Strong | logging-failures, sensitive-data-leakage |
| A10: Server-Side Request Forgery | Strong | vuln-patterns, framework-patterns, vulnerability-chains |
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Out of scope for this plugin's code-review workflow. If the user needs this category:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
When mapping a finding, prefer this shape:
- OWASP: A03 Injection
- CWE: CWE-89
- Why it fits: user-controlled input reaches SQL execution without parameter binding
hotspot into a reportable finding just to fill an OWASP bucket.na_cpg, not false_positive.