security-auditlisted

Performs a complete application security analysis based on the OWASP Top 10 (2025). Use this skill whenever the user mentions: security audit, OWASP analysis, security code review, application vulnerabilities, application pentest, security review, security flaw, API security, code verification, hardening, or asks to verify the security of code, an architecture, or a configuration. Also trigger for terms such as: SQL injection, XSS, CSRF, weak authentication, secrets in code, sensitive data exposure, access control, SSRF. This skill orchestrates 10 OWASP category reference guides and produces a structured, actionable report.
ayman-benmada/owasp-security-audit · ★ 0 · API & Backend · score 60

Install: claude install-skill ayman-benmada/owasp-security-audit

# OWASP Security Audit - Main Skill This skill orchestrates the application security analysis according to the **OWASP Top 10 (2025)**. It coordinates 10 category reference guides (`references/A0X-*.md`) and produces a structured vulnerability report. --- ## Step 1 - Context Gathering Before any analysis, identify the context available. If the user has provided only limited information, ask **at most 4 targeted questions** before starting, do not block the analysis if the context is sufficient. The report level and language can be combined into a single question. **Information to collect:** - Nature of the target: source code / architecture / configuration / functional description - Language(s) and framework(s) used - Desired scope: complete analysis (A01 to A10) or specific category/categories - Desired report level: executive (summary) / technical (detailed) / exhaustive (with complete remediation) - **Report language**: ask for the desired language (default: **English**). Options: English, French, Spanish. Store the choice and apply it to the entire report (Step 5), including the Execution Context validation prompts (Step 2). > If the context is partial, perform the analysis on what is visible and flag the limitations in the "Limitations" section. --- ## Step 1.5 - Technical Stack Detection Identify the stack before analyzing in order to **prioritize the most relevant patterns** and avoid false positives caused by incorrect context. ### Signals to detect ```bas