Security review and implementation support based on OWASP Cheat Sheet Series. Use for code review requests, security-related implementation/research, and vulnerability checks. Covers security topics such as XSS, SQL Injection, CSRF, and authentication/authorization.
Performs security reviews using OWASP Cheat Sheets to identify vulnerabilities like XSS, SQL injection, and authentication flaws. Triggers on code review requests, security implementation tasks, and vulnerability checks.
/plugin marketplace add ayuzaka/my-develop-plugin/plugin install owasp-security-review@agent-plugins-marketplaceThis skill is limited to using the following tools:
references/top10-mapping.mdscripts/setup_cheatsheets.shPerform code security reviews based on the OWASP Cheat Sheet Series, identifying vulnerabilities and providing remediation recommendations.
If the Cheat Sheet repository has not been cloned:
bash scripts/setup_cheatsheets.sh
By default, it clones to ~/.local/share/owasp-cheatsheets.
Identify relevant security categories from the code:
| Code Pattern | OWASP Top 10 Category |
|---|---|
| User input handling | A03: Injection |
| SQL queries | A03: Injection |
| HTML output | A03: Injection (XSS) |
| Authentication logic | A07: Authentication Failures |
| Session handling | A07: Authentication Failures |
| Access control checks | A01: Broken Access Control |
| Cryptography, passwords | A02: Cryptographic Failures |
| File uploads | A05: Security Misconfiguration |
| External API calls | A10: SSRF |
| Deserialization | A08: Data Integrity Failures |
| Dependencies | A06: Vulnerable Components |
| Logging | A09: Logging Failures |
Refer to top10-mapping.md to identify the applicable Cheat Sheets.
Load a Cheat Sheet:
cat ~/.local/share/owasp-cheatsheets/cheatsheets/<CheatSheet_Name>.md
## Security Review Summary
### Findings
#### [Severity: Critical/High/Medium/Low] Finding Title
- **Location**: file:line
- **Issue**: Description of the problem
- **OWASP Category**: A0X: Category Name
- **Reference**: Cheat Sheet name
- **Recommendation**: Remediation with code examples
Present implementation guidance or research findings based on Cheat Sheet content. Always cite the source Cheat Sheet.
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.