사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/owasp/secure-agent-playbook --skill web-security-review시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
Web Security Review (OWASP Top 10)
Review web applications against all 10 OWASP Top 10 risks by following the full procedure in plays/owasp-top10-web-review.md.
Steps
- Application Mapping — Identify framework/language, deployment model (monolith/microservices), trust boundaries (internet/internal/local), data sensitivity (PII, financial, health), and authentication mechanisms.
- Assess Each OWASP Top 10 Risk:
- A01 Broken Access Control — Missing authz checks, IDOR, privilege escalation, path traversal, CORS misconfigurations
- A02 Cryptographic Failures — Weak algorithms, missing TLS, hardcoded keys, improper key management, cleartext storage
- A03 Injection — SQLi, NoSQLi, OS command injection, LDAP injection, XSS, SSTI, XPath injection
- A04 Insecure Design — Missing security requirements, business logic flaws, insecure workflows, threat modeling gaps
- A05 Security Misconfiguration — Default configs, verbose errors, missing headers, unnecessary features, outdated components
- A06 Vulnerable Components — Unpatched libraries, unsupported dependencies, lack of inventory, missing SBOM
- A07 Identification & Auth Failures — Weak passwords, session issues, MFA gaps, credential stuffing, brute force
- A08 Software & Data Integrity Failures — Insecure deserialization, unsigned updates, CI/CD attacks, dependency confusion
- A09 Security Logging & Monitoring Failures — Missing audit logs, insufficient monitoring, no incident response capability
- A10 Server-Side Request Forgery (SSRF) — Unvalidated URL parameters, internal service access, cloud metadata endpoints
- Framework-Specific Analysis — Apply checks for detected framework (React, Angular, Vue, Express, Django, Flask, Rails, Spring, ASP.NET, Laravel).
- Configuration Review — Examine web server configs (nginx, Apache), application configs, and deployment manifests for security settings.
Output
Application overview, risk matrix for all 10 categories with severity/status, detailed findings using templates/finding.md, positive controls observed, and prioritized remediation roadmap.
OWASP References
- OWASP Top 10 for Web Applications (2021)
- OWASP ASVS v5.0 — Application Security Verification Standard
- OWASP Testing Guide (WSTG)
- OWASP Cheat Sheet Series
