From ts-dev-kit
Reviews code and architectures against OWASP Top 10:2025 web application security risks. Useful for vulnerability audits, codebase reviews, remediation guidance, and secure coding patterns.
npx claudepluginhub jgamaraalv/ts-dev-kit --plugin ts-dev-kitThis skill uses the workspace's default tool permissions.
<quick_reference>
references/a01-broken-access-control.mdreferences/a02-security-misconfiguration.mdreferences/a03-supply-chain-failures.mdreferences/a04-cryptographic-failures.mdreferences/a05-injection.mdreferences/a06-insecure-design.mdreferences/a07-authentication-failures.mdreferences/a08-integrity-failures.mdreferences/a09-logging-alerting-failures.mdreferences/a10-exceptional-conditions.mdtemplate.mdAudits web app codebases against OWASP Top 10 (2021) vulnerabilities like broken access control, IDOR, insecure configs with file:line findings and remediation. Quick or deep scan modes.
Performs OWASP Top 10 2025 security code reviews on JavaScript/TypeScript, Python, Java, and Go code. Reports vulnerabilities with severity, locations, risks, and fixes.
Reviews project code against OWASP Top 10 vulnerabilities: broken access control, injections (SQL, XSS, CSRF), cryptographic failures, insecure design, misconfigurations, and authentication issues.
Share bugs, ideas, or general feedback.
<quick_reference>
| # | Category | Key risk | Avg incidence |
|---|---|---|---|
| A01 | Broken Access Control | Unauthorized data access, privilege escalation, SSRF, CSRF | 3.74% |
| A02 | Security Misconfiguration | Default creds, verbose errors, missing hardening, XXE | 3.00% |
| A03 | Software Supply Chain Failures | Vulnerable/malicious dependencies, compromised build pipelines | 5.72% |
| A04 | Cryptographic Failures | Weak algorithms, hardcoded keys, missing encryption, weak hashing | 3.80% |
| A05 | Injection | SQLi, XSS, command injection, LDAP/XPath/EL injection | 3.08% |
| A06 | Insecure Design | Missing threat modeling, business logic flaws, insufficient controls | 1.86% |
| A07 | Authentication Failures | Credential stuffing, weak passwords, session fixation, missing MFA | 2.92% |
| A08 | Software/Data Integrity Failures | Unsigned updates, insecure deserialization, untrusted CDN code | 2.75% |
| A09 | Security Logging & Alerting Failures | Missing audit logs, no alerting, log injection, sensitive data in logs | 3.91% |
| A10 | Mishandling of Exceptional Conditions | Failing open, info leakage via errors, unchecked return values | 2.95% |
Use these severity levels when reporting findings:
</quick_reference>
<phase_1_code_review>
Systematically check the code against each relevant category:
Priority order for review (highest impact first):
[CRITICAL] Input handling code → A05 (Injection), A01 (Access Control)[CRITICAL] Auth/session code → A07 (Authentication), A01 (Access Control)[HIGH] Data storage/transmission → A04 (Cryptographic Failures)[HIGH] Configuration/deployment → A02 (Security Misconfiguration)[HIGH] Dependencies → A03 (Supply Chain)[MEDIUM] Error handling → A10 (Exceptional Conditions), A09 (Logging)[MEDIUM] Architecture/design → A06 (Insecure Design)[MEDIUM] Data integrity → A08 (Integrity Failures)
</phase_1_code_review><phase_2_audit_checklist>
Generate a checklist for a feature or codebase:
<phase_3_remediation>
When a vulnerability is identified:
Load the relevant file when you need detailed guidance for a specific category: