outskill-owasp-security-review

KO | EN

gitlite — search

#python #hacktoberfest #react #ai #golang #go #machine-learning #nodejs #macos #java #windows #security #mcp #openai

outskill-owasp-security-review

(★ 11)

A Claude Code skill: launch-gate security review against the OWASP Top 10 (2025) for Next.js + Supabase + OpenAI apps, explained in plain language. Built from a verified 25-subagent audit.

outskill-owasp-security-review 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# OWASP Security Review — a Claude Code Skill

A plug-in **[Claude Code](https://claude.com/claude-code) skill** that runs a launch-gate **security review against the [OWASP Top 10 (2025)](https://owasp.org/Top10/)** on a Next.js + Supabase + OpenAI codebase — and explains every finding in plain language, so a non-coder can act on it.

It was purpose-built for the **[Vibe CRM Security Lab](https://github.com/harshith-vaddiparthy/vibe-crm-security-lab)** (a deliberately-vulnerable teaching CRM), but the methodology and the per-category checklist work as a general OWASP-2025 review for any modern Next.js App Router + Supabase app.

> **TL;DR** — Type `/owasp-security-review` in Claude Code. It maps all 10 OWASP 2025 risks to the exact files in your repo, rates severity, and points at the concrete fix — no security jargon required.

---

## Why this exists

Most "AI security review" is generic: it lists the OWASP Top 10 and hand-waves. This skill is the opposite — it is **grounded in one real codebase**. Every finding names a real file, a real line of reasoning, and (where the lab provides one) the **correct version already sitting next to the broken one**.

It's written for an owner who **prompts but doesn't read code**. So instead of "IDOR on the contact endpoint," it says: *"Anyone can read another company's customer by changing a number in the web address — here's the file, here's why it's a breach with real data, here's the one-line fix."*

---

## How it was built (multi-agent, verified)

This skill isn't hand-waved from memory. It was generated by an orchestrated **25-subagent audit**:

1. **Recon (5 agents in parallel)** — one agent extracted the *real* OWASP Top 10 2025 list from the official source docs (not from training data); four dissected the target app's architecture, authentication/access-control, data/API layer, and secrets/config posture.
2. **Map (10 agents)** — one agent per OWASP 2025 category cross-referenced the category against the codebase and produced file-grounded review guidance.
3. **Verify (10 agents)** — a separate **adversarial** agent re-checked every mapping against the live tree: confirming each referenced file actually exists and each applicability claim holds, dropping anything hallucinated.

All 10 categories came back **grounded at high confidence**, and the handful of flagged corrections (e.g. exact dependency count, which routes declare which directives) were re-verified by hand before being written down. The result is the `references/owasp-2025-crm-map.md` you'll find here.

---

## What's in the box

```
outskill-owasp-security-review/
├── owasp-security-review/                 ← the skill (this folder goes into ~/.claude/skills/)
│   ├── SKILL.md                           ← the playbook: how to run the review, the 10-category index, report format
│   └── references/
│       └── owasp-2025-crm-map.md          ← the deep map: each OWASP 2025 category → exact files, red flags, fixes, grep commands
├── LICENSE                                ← MIT
└── README.md                              ← you are here
```

- **`SKILL.md`** is what Claude Code loads first. It's lean: context, the two operating modes, the at-a-glance category table, and the report format.
- **`references/owasp-2025-crm-map.md`** is loaded on demand for depth. For each category it gives: a plain-English definition, *where the risk lives* (specific files), red-flag code patterns, the **good pattern** (often the repo's own fixed route), `grep` commands to surface instances, and a launch-gate verdict.

---

## Install

Claude Code discovers skills in `~/.claude/skills/`. Drop the `owasp-security-review/` folder there.

**Option A — clone and copy:**
```bash
git clone https://github.com/harshith-vaddiparthy/outskill-owasp-security-review.git
cp -R outskill-owasp-security-review/owasp-security-review ~/.claude/skills/
```

**Option B — symlink (so `git pull` keeps it updated):**
```bash
git clone https://github.com/harshith-vaddiparthy/outskill-owasp-security-review.git
ln -s "$(pwd)/outskill-owasp-security-review/owasp-security-review" ~/.claude/skills/owasp-security-review
```

Then restart Claude Code (or start a new session). Confirm it's picked up:
```bash
ls ~/.claude/skills/owasp-security-review
```

> Want it available in every project? `~/.claude/skills/` is global. To scope it to a single repo instead, put the folder in that repo's `.claude/skills/` directory.

---

## Use

From a Claude Code session inside the target repo:

```
/owasp-security-review
```

The skill runs in one of **two modes** — it will ask if it's ambiguous:

| Mode | When | What you get |
|------|------|--------------|
| **Lab walkthrough** (default) | The repo is a teaching lab with intentional vulnerable↔fixed pairs | Each demo explained in OWASP-2025 terms; confirms the curriculum is intact |
| **Launch-gate review** | You're hardening a real app, or ask "is this safe to launch with real customer data?" | A prioritized blocker list: what *must* change before real data flows in |

Natural-language prompts work too, e.g. *"review my CRM for security issues,"* *"find the launch blockers,"* *"check tenant isolation and secrets,"* or *"map my code to the OWASP Top 10."*

### Sample output shape

```
## CRM Security Review — Launch-gate mode
[plain-English summary + the headline risk]

---

## OWASP Top 10 (2025) coverage

Verified against the reference application. "Applies" reflects that specific codebase; on your own app, re-run the review.

| ID | Category | Applies | Headline issue in the reference app |
|----|----------|:---:|-------------------------------------|
| **A01** | Broken Access Control | HIGH | Any user reads/writes any tenant's data; admin route has no role check |
| **A02** | Security Misconfiguration | HIGH | No security headers; a secret-dumping debug component on every page; `.gitignore` rigged to commit `.env` |
| **A03** | Software Supply Chain Failures | MEDIUM | Hundreds of npm packages with zero scanning / CI / SBOM |
| **A04** | Cryptographic Failures | MEDIUM | Base64 mistaken for a session token; hard-coded, leaked signing key; plaintext password; no HSTS |
| **A05** | Injection | HIGH | SQLi-style tautology dumps all tenants; AI prompt injection (direct + indirect) |
| **A06** | Insecure Design | HIGH | The trust boundary was never designed — identity is a forgeable header, even in the "fixed" routes |
| **A07** | Authentication Failures | HIGH | No login / MFA / password; identity = spoofable header; fails **open** to an owner account |
| **A08** | Software or Data Integrity Failures | MEDIUM | Unsigned, client-controlled identity trusted with no integrity check |
| **A09** | Security Logging & Alerting Failures | HIGH | Zero audit logging; the only log calls *leak* secrets; silent denials |
| **A10** | Mishandling of Exceptional Conditions | HIGH | Unguarded body parse, raw errors to the client, no rate limits, fails open |

*New/changed in 2025: **A03 Software Supply Chain** and **A10 Mishandling of Exceptional Conditions** are new/expanded; SSRF folded into **A01**; "Identification and Authentication Failures" renamed to **A07 Authentication Failures**.*

---

## Design principles

- **Plain language first.** State *what's wrong*, *why it matters with real data*, and *the smallest fix* before any code.
- **Cite the fix that already exists.** When the codebase ships a correct counterpart (a `/fixed/*` route, an RLS policy), point at it instead of inventing a new pattern.
- **Verify before asserting.** The reference doc is a point-in-time audit; the skill is instructed to re-open files and confirm a finding still holds. **The code is the source of truth, not this skill.**
- **Never print secrets** — even fake placeholder ones. Name the variable only. Build the habit.
- **Defensive only.** This is a review-and-explain tool for code you own. It does not write exploit tooling.

---

## Adapting it to your own app

The `references/owasp-2025-crm-map.md` file is tuned to a specific Next.js + Supabase + OpenAI CRM (file names like `api/fixed/*`, `getDemoUser`, `supabase/rls-*.sql`). To retarget it:

1. Keep the **category definitions, red flags, good patterns, and grep commands** — they're broadly applicable to any Next.js App Router + Supabase stack.
2. Replace the **"Where the risk lives"** file references with your own routes and modules.
3. Re-run the review in your repo; let the skill re-confirm what actually applies.

---

## Contributing

Issues and PRs welcome — especially:
- Additional red-flag patterns or grep recipes for the Next.js + Supabase stack.
- Generalizing the reference beyond the original lab app.
- Keeping the mapping current as OWASP iterates the Top 10.

---

## License

The OWASP Top 10 is a project of the [Open Worldwide Application Security Project](https://owasp.org/) and is referenced here for educational use; this repository is not affiliated with or endorsed by OWASP.

outskill-owasp-security-review

outskill-owasp-security-review 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

outskill-owasp-security-review

outskill-owasp-security-review 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README