Security review and implementation support based on OWASP Cheat Sheet Series. Use for code review requests, security-related implementation/research, and vulnerability checks. Covers security topics such as XSS, SQL Injection, CSRF, and authentication/authorization.
Performs security reviews using OWASP Cheat Sheets to identify vulnerabilities like XSS, SQL injection, and authentication flaws. Triggers on code review requests, security implementation tasks, and vulnerability checks.
/plugin marketplace add ayuzaka/agent-plugins/plugin install owasp-security-review@agent-plugins-marketplaceThis skill is limited to using the following tools:
references/top10-mapping.mdscripts/setup_cheatsheets.shPerform code security reviews based on the OWASP Cheat Sheet Series, identifying vulnerabilities and providing remediation recommendations.
If the Cheat Sheet repository has not been cloned:
bash scripts/setup_cheatsheets.sh
By default, it clones to ~/.local/share/owasp-cheatsheets.
Identify relevant security categories from the code:
| Code Pattern | OWASP Top 10 Category |
|---|---|
| User input handling | A03: Injection |
| SQL queries | A03: Injection |
| HTML output | A03: Injection (XSS) |
| Authentication logic | A07: Authentication Failures |
| Session handling | A07: Authentication Failures |
| Access control checks | A01: Broken Access Control |
| Cryptography, passwords | A02: Cryptographic Failures |
| File uploads | A05: Security Misconfiguration |
| External API calls | A10: SSRF |
| Deserialization | A08: Data Integrity Failures |
| Dependencies | A06: Vulnerable Components |
| Logging | A09: Logging Failures |
Refer to top10-mapping.md to identify the applicable Cheat Sheets.
Load a Cheat Sheet:
cat ~/.local/share/owasp-cheatsheets/cheatsheets/<CheatSheet_Name>.md
## Security Review Summary
### Findings
#### [Severity: Critical/High/Medium/Low] Finding Title
- **Location**: file:line
- **Issue**: Description of the problem
- **OWASP Category**: A0X: Category Name
- **Reference**: Cheat Sheet name
- **Recommendation**: Remediation with code examples
Present implementation guidance or research findings based on Cheat Sheet content. Always cite the source Cheat Sheet.