OWASP Top 10-based security review and vulnerability detection. Triggers: セキュリティ, 脆弱性, XSS, SQL injection, SQLインジェクション, CSRF, 認証, 認可, 暗号化, OWASP, SSRF, パスワード, セッション, rate limiting, brute force, command injection, security misconfiguration.
/plugin marketplace add thkt/claude-config/plugin install complete-workflow-system@thkt-development-workflowsThis skill is limited to using the following tools:
EVALUATIONS.mdreferences/owasp-advanced.mdreferences/owasp-basic.mdreferences/owasp-injection.mdOWASP Top 10-based vulnerability detection and secure implementation guidance.
| Section | File | Focus | Triggers |
|---|---|---|---|
| Basic Security | references/owasp-basic.md | OWASP 1,2,7: Access Control, Crypto, Auth | auth, password, session |
| Injection | references/owasp-injection.md | OWASP 3: SQL/NoSQL/Command, XSS, CSRF | injection, XSS, CSRF |
| Advanced | references/owasp-advanced.md | OWASP 4-6,8-10: Design, Config, Monitoring, SSRF | rate limiting, SSRF, logging |
Run audit command for your package manager:
npm: npm audit
yarn: yarn audit
pnpm: pnpm audit
bun: bun pm trust (or check lockfile)
No known vulnerabilities
| Principle | Description |
|---|---|
| Defense in Depth | Don't rely on single measure |
| Least Privilege | Minimal permissions |
| Fail Securely | Safe even when failing |
| Security by Default | Secure by default |
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.