owasp-top10

name	owasp-top10
description	Use this skill when analyzing code for OWASP Top 10 vulnerabilities. Provides structured guidance for identifying common web application security risks.
license	MIT
metadata	{"author":"absoluteappsec","version":"1.0"}

OWASP Top 10 Analysis Skill

Overview

This skill provides structured guidance for analyzing code against the OWASP Top 10 2021 vulnerability categories.

Instructions

When performing security analysis, check for these vulnerability categories:

A01:2021 - Broken Access Control

• Missing authorization checks on sensitive operations
• IDOR (Insecure Direct Object References)
• Path traversal vulnerabilities
• Missing function-level access control

A02:2021 - Cryptographic Failures

• Weak encryption algorithms (MD5, SHA1 for passwords)
• Hardcoded secrets or API keys
• Sensitive data transmitted in cleartext
• Missing encryption for sensitive data at rest

A03:2021 - Injection

• SQL Injection (raw queries, string concatenation)
• Command Injection (os.system, subprocess with shell=True)
• Template Injection
• LDAP Injection
• XPath Injection

A04:2021 - Insecure Design

• Missing rate limiting
• Lack of input validation
• Trust boundary violations
• Missing security controls in business logic

A05:2021 - Security Misconfiguration

• DEBUG=True in production
• Default credentials
• Verbose error messages exposing internals
• Unnecessary features enabled

A06:2021 - Vulnerable Components

• Outdated dependencies
• Known vulnerable libraries
• Unpatched frameworks

A07:2021 - Authentication Failures

• Weak password policies
• Missing brute-force protection
• Session fixation
• Credential stuffing vulnerabilities

A08:2021 - Data Integrity Failures

• Insecure deserialization
• Missing integrity checks
• Unsigned updates

A09:2021 - Security Logging Failures

• Missing audit logs for sensitive operations
• Logging sensitive data (passwords, tokens)
• Insufficient monitoring

A10:2021 - SSRF

• User-controlled URLs in server-side requests
• Missing URL validation
• Internal network exposure

Output Format

For each finding, provide:

• Vulnerability category (A01-A10)
• File and line number
• Code snippet demonstrating the issue
• Risk rating (Critical/High/Medium/Low)
• Remediation recommendation