| name | mapping-findings-to-owasp-top10 |
| description | Annotate every pentest finding with its OWASP Top 10 (2021)
category by applying a deterministic rule table keyed on source
skill, finding category, detail keywords, and CWE identifier when
present. Produces an enriched findings JSONL plus a per-category
rollup report showing how findings distribute across A01 through
A10. Required for customer-facing OWASP coverage sections and
compliance contexts (PCI DSS 6.5, SOC2 CC7, ISO 27001 A.14.2).
Use when: enriching findings after cluster 1-4 scans, regenerating
the report with OWASP tags, producing the OWASP coverage section
for an exec summary, or auditing engagement OWASP coverage.
Threshold: unclassifiable findings emitted as INFO with UNMAPPED
category for operator review.
Trigger with: "map to OWASP", "owasp top 10 mapping",
"annotate owasp categories", "owasp coverage check".
|
| allowed-tools | ["Read","Write","Bash(python3:*)","Glob"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","reporting","owasp","top10","pentest"] |
Mapping Findings to OWASP Top 10
Overview
OWASP Top 10 is the canonical taxonomy of web-application risk
categories. Every customer-facing pentest report has an "OWASP
coverage" section because customers, auditors, and insurers
expect to see findings mapped against the Top 10. Without the
mapping, a long list of CVEs and misconfigurations reads as
noise; with the mapping, it reads as a structured assessment.
This skill applies a deterministic rule table to annotate each
finding with its OWASP category. Rules are keyed on:
- Source skill ID (a finding from
auditing-npm-dependencies
is almost always A06 — Vulnerable and Outdated Components).
- Finding category (the per-skill category tag, e.g.
dependency-vulnerability, engagement-scope).
- CWE identifier if present (CWE → OWASP is a well-trodden
mapping; OWASP themselves publish the cross-walk).
- Detail keywords as a fallback when the above don't
determine a category.
Output is an enriched JSONL (each finding gets an owasp_category
field) plus a coverage report showing how the engagement's
findings distribute across A01-A10. UNMAPPED findings are
surfaced for human review — extend the rule table or accept the
finding as cross-cutting (some findings genuinely don't fit a
single A0X bucket).
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| Finding unmapped after rule application | INFO | No rule matched the finding | (operational) |
| Source JSONL unparseable | HIGH | Standard JSONL parse error | (operational) |
| Annotation written back successfully | INFO | Confirmation per source file | (informational) |
| Coverage report generated | INFO | Coverage report path emitted | (informational) |
| Engagement covers all 10 categories | INFO | At least one finding in each A01-A10 bucket | (positive observation) |
| Engagement covers <5 of 10 categories | MEDIUM | Suggests scope may have been narrow |
