web-security-review

Review web applications against the OWASP Top 10 for Web Applications (2021). Use when auditing web apps, reviewing server-side code, or assessing web frameworks for the classic OWASP Top 10 risks including injection, broken auth, and XSS.

Jump to install

Repository: OWASP/secure-agent-playbook
Last source activity: May 17, 2026 at 20:08
Detected SKILL.md language: English
Stars: 158
Forks: 20

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/OWASP/secure-agent-playbook --skill web-security-review

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

Web Security Review (OWASP Top 10)

Review web applications against all 10 OWASP Top 10 risks by following the full procedure in plays/owasp-top10-web-review.md.

Steps

Application Mapping — Identify framework/language, deployment model (monolith/microservices), trust boundaries (internet/internal/local), data sensitivity (PII, financial, health), and authentication mechanisms.

Assess Each OWASP Top 10 Risk:

A01 Broken Access Control — Missing authz checks, IDOR, privilege escalation, path traversal, CORS misconfigurations
A02 Cryptographic Failures — Weak algorithms, missing TLS, hardcoded keys, improper key management, cleartext storage
A03 Injection — SQLi, NoSQLi, OS command injection, LDAP injection, XSS, SSTI, XPath injection
A04 Insecure Design — Missing security requirements, business logic flaws, insecure workflows, threat modeling gaps
A05 Security Misconfiguration — Default configs, verbose errors, missing headers, unnecessary features, outdated components
A06 Vulnerable Components — Unpatched libraries, unsupported dependencies, lack of inventory, missing SBOM
A07 Identification & Auth Failures — Weak passwords, session issues, MFA gaps, credential stuffing, brute force
A08 Software & Data Integrity Failures — Insecure deserialization, unsigned updates, CI/CD attacks, dependency confusion
A09 Security Logging & Monitoring Failures — Missing audit logs, insufficient monitoring, no incident response capability
A10 Server-Side Request Forgery (SSRF) — Unvalidated URL parameters, internal service access, cloud metadata endpoints

Framework-Specific Analysis — Apply checks for detected framework (React, Angular, Vue, Express, Django, Flask, Rails, Spring, ASP.NET, Laravel).

Configuration Review — Examine web server configs (nginx, Apache), application configs, and deployment manifests for security settings.

Output

Application overview, risk matrix for all 10 categories with severity/status, detailed findings using templates/finding.md, positive controls observed, and prioritized remediation roadmap.

OWASP References

OWASP Top 10 for Web Applications (2021)

OWASP ASVS v5.0 — Application Security Verification Standard

OWASP Testing Guide (WSTG)

OWASP Cheat Sheet Series