How to use
- Copy the installation command and review the source package before installing it in your own agent environment.
- Check the source document for required tools, credentials and supported hosts.
- Describe your input and desired deliverable; review the output against the source material.
npx skills add https://github.com/owasp/secure-agent-playbook --skill web-security-reviewBefore you start
- Installation does not include a model subscription, API allowance or permission to access your files.
- Repository stars and installation counts describe activity, not an independent quality or security test.
Original skill document
Rendered from the source repository. Headings, examples, code, tables, links, and referenced images are preserved.
Web Security Review (OWASP Top 10)
Review web applications against all 10 OWASP Top 10 risks by following the full procedure in plays/owasp-top10-web-review.md.
Steps
- Application Mapping — Identify framework/language, deployment model (monolith/microservices), trust boundaries (internet/internal/local), data sensitivity (PII, financial, health), and authentication mechanisms.
- Assess Each OWASP Top 10 Risk:
- A01 Broken Access Control — Missing authz checks, IDOR, privilege escalation, path traversal, CORS misconfigurations
- A02 Cryptographic Failures — Weak algorithms, missing TLS, hardcoded keys, improper key management, cleartext storage
- A03 Injection — SQLi, NoSQLi, OS command injection, LDAP injection, XSS, SSTI, XPath injection
- A04 Insecure Design — Missing security requirements, business logic flaws, insecure workflows, threat modeling gaps
- A05 Security Misconfiguration — Default configs, verbose errors, missing headers, unnecessary features, outdated components
- A06 Vulnerable Components — Unpatched libraries, unsupported dependencies, lack of inventory, missing SBOM
- A07 Identification & Auth Failures — Weak passwords, session issues, MFA gaps, credential stuffing, brute force
- A08 Software & Data Integrity Failures — Insecure deserialization, unsigned updates, CI/CD attacks, dependency confusion
- A09 Security Logging & Monitoring Failures — Missing audit logs, insufficient monitoring, no incident response capability
- A10 Server-Side Request Forgery (SSRF) — Unvalidated URL parameters, internal service access, cloud metadata endpoints
- Framework-Specific Analysis — Apply checks for detected framework (React, Angular, Vue, Express, Django, Flask, Rails, Spring, ASP.NET, Laravel).
- Configuration Review — Examine web server configs (nginx, Apache), application configs, and deployment manifests for security settings.
Output
Application overview, risk matrix for all 10 categories with severity/status, detailed findings using templates/finding.md, positive controls observed, and prioritized remediation roadmap.
OWASP References
- OWASP Top 10 for Web Applications (2021)
- OWASP ASVS v5.0 — Application Security Verification Standard
- OWASP Testing Guide (WSTG)
- OWASP Cheat Sheet Series
