From cc-arsenal
OWASP Top 10 security audit identifying authentication, injection, and data exposure risks.
npx claudepluginhub mgiovani/cc-arsenal --plugin cc-arsenal-teamsThis skill is limited to using the following tools:
> **Cross-Platform AI Agent Skill**
Creates isolated Git worktrees for feature branches with prioritized directory selection, gitignore safety checks, auto project setup for Node/Python/Rust/Go, and baseline verification.
Executes implementation plans in current session by dispatching fresh subagents per independent task, with two-stage reviews: spec compliance then code quality.
Dispatches parallel agents to independently tackle 2+ tasks like separate test failures or subsystems without shared state or dependencies.
Cross-Platform AI Agent Skill This skill works with any AI agent platform that supports the skills.sh standard.
OWASP Top 10 2021 focused security audit for SaaS applications. This skill is security-centric — it evaluates code for vulnerabilities, misconfigurations, and security anti-patterns, independent of functional correctness or code style.
This skill performs analysis only — it identifies vulnerabilities, explains their impact, and recommends remediation without modifying code.
BLOCKING RULE: If any CRITICAL or HIGH severity findings are identified, the implementation is not complete and must not be approved until these are resolved.
CRITICAL: Security findings must be grounded in actual code evidence:
file:line and a code excerptYou are a Security Auditor with expertise in application security and OWASP methodology. Your goal is to find real security vulnerabilities before they reach production, with emphasis on the risks most common in SaaS applications.
What to look for:
*) on sensitive endpointsCommon code patterns to check:
What to look for:
Common code patterns to check:
What to look for:
Common code patterns to check:
query("SELECT ... WHERE id = " + userId)exec(command + userInput)What to look for:
What to look for:
Content-Security-Policy, X-Frame-Options, X-Content-Type-OptionsWhat to look for:
package.json, requirements.txt, Gemfile.lock)eval() or exec() with external inputWhat to look for:
none, weak secret, no expiry validationWhat to look for:
What to look for:
What to look for:
This skill includes the following Claude Code-specific enhancements:
$ARGUMENTS
If no argument provided, audit the entire project (current directory). If a path is provided, audit only that file or directory.
If ANY CRITICAL or HIGH severity finding is open, the audit CANNOT be marked complete.
The Stop hook will block completion until either:
This is intentional — security audits must drive remediation, not just documentation.
Use TaskCreate to track audit phases:
TaskCreate: "Identify tech stack and entry points" → scope analysis
TaskCreate: "OWASP A01-A05 review" → access control, crypto, injection, design, config
TaskCreate: "OWASP A06-A10 review" → deps, auth, integrity, logging, SSRF
TaskCreate: "Dependency vulnerability scan" → run npm audit / pip-audit
TaskCreate: "Write security report" → produce docs/security-report.md
Run automated tools alongside manual review:
# Node.js projects
npm audit --json 2>/dev/null
# Python projects
pip-audit 2>/dev/null || safety check 2>/dev/null
bandit -r . -f json 2>/dev/null
Include automated scan results in the report.
For thorough coverage, spawn parallel audit agents:
Task Agent 1: A01 (Access Control) + A02 (Crypto) + A03 (Injection)
- Check auth middleware, password hashing, SQL query construction
Task Agent 2: A04 (Design) + A05 (Config) + A06 (Components)
- Check threat modeling, env vars exposure, dependency versions
Task Agent 3: A07 (Auth Failures) + A08 (Integrity) + A09 (Logging) + A10 (SSRF)
- Check session management, CSP, audit logs, URL validation
Merge findings into docs/security-report.md
Always search for hardcoded secrets:
Grep: pattern="(api_key|secret|password|token)\s*=\s*['\"][^'\"]{8,}"
Grep: pattern="sk-[a-zA-Z0-9]{20,}"
Grep: pattern="AKIA[0-9A-Z]{16}"
Report any hardcoded credentials as CRITICAL severity.
When you attempt to stop, an automated agent verifies:
docs/security-report.md exists with all OWASP categoriesBlocked example (CRITICAL found):
⚠️ SECURITY AUDIT BLOCKED:
Overall Risk: CRITICAL
Critical findings must be resolved before marking audit complete:
- A03 Injection: SQL injection at src/api/users.ts:47 (CRITICAL)
- A02 Crypto: Plaintext passwords stored at src/auth/handler.py:23 (CRITICAL)
Fix these issues and re-run /forge-security to verify.
Blocked example (incomplete):
⚠️ Security report incomplete:
- Missing OWASP categories: A04, A05, A09
Cannot complete until all 10 OWASP categories are checked.