Menu
Full pre-ship security review that runs all ten OWASP Top 10 checks in sequence. Use before any significant feature ships to production.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Checks for server-side request forgery risk before any code that makes outbound HTTP requests based on user-supplied URLs or parameters is written or modified.
Requires structured security event logging before any authentication, authorization, or sensitive data access code ships.
Checks deserialization safety, CI/CD pipeline integrity, and dependency integrity before any code that deserializes objects or executes pipeline scripts is written or modified.
Enforces secure authentication patterns before any login, session, token, or credential management code is written or modified.
Checks CVE status, license compatibility, and maintenance health of any new dependency before it enters the codebase.
Checks for insecure default settings, exposed debug endpoints, permissive CORS, open cloud storage, and missing security headers before any configuration or deployment code ships.
| name | owasp-security-gate |
| description | Full pre-ship security review that runs all ten OWASP Top 10 checks in sequence. Use before any significant feature ships to production. |
| when_to_use | Use explicitly with /owasp-security-gate before merging a feature that touches authentication, data access, external requests, or configuration. Also use when asked to do a full security review. |
This skill runs all ten OWASP Top 10 (2021) checks in sequence. Use it before a feature ships, before a PR is marked ready for review, or any time a full security review is needed.
Each check below maps to a dedicated skill. Run them in order. Mark each CLEAR or BLOCKED. If any check is BLOCKED, the feature does not ship until it is resolved.
Apply broken-access-control skill.
Trigger: any code that retrieves, modifies, or deletes user data.
Key questions:
Apply cryptographic-failures skill.
Trigger: any code that stores or transmits passwords, tokens, or PII.
Key questions:
Apply injection-check skill.
Trigger: any code that incorporates user input into SQL, shell commands, HTML, or LDAP.
Key questions:
Apply insecure-design skill.
Trigger: any new user-facing feature, auth flow, or data handling system.
Key questions:
Apply security-misconfiguration skill.
Trigger: any configuration, infrastructure, or deployment code.
Key questions:
Apply vulnerable-components skill.
Trigger: any new or upgraded dependency.
Key questions:
Apply auth-failures skill.
Trigger: any login, session, token, or credential code.
Key questions:
Apply data-integrity-failures skill.
Trigger: any deserialization, CI pipeline, or update mechanism code.
Key questions:
Apply security-logging-failures skill.
Trigger: any authentication, authorization, or sensitive data access code.
Key questions:
Apply ssrf-check skill.
Trigger: any code that fetches a URL based on user input.
Key questions:
After running all ten checks:
## OWASP Security Gate Report
**Feature:** [name]
**Date:** [YYYY-MM-DD]
| Check | OWASP | Status | Blocker |
|---|---|---|---|
| broken-access-control | A01 | CLEAR / BLOCKED | [issue if blocked] |
| cryptographic-failures | A02 | CLEAR / BLOCKED | |
| injection-check | A03 | CLEAR / BLOCKED | |
| insecure-design | A04 | CLEAR / BLOCKED | |
| security-misconfiguration | A05 | CLEAR / BLOCKED | |
| vulnerable-components | A06 | CLEAR / BLOCKED | |
| auth-failures | A07 | CLEAR / BLOCKED | |
| data-integrity-failures | A08 | CLEAR / BLOCKED | |
| security-logging-failures | A09 | CLEAR / BLOCKED | |
| ssrf-check | A10 | CLEAR / BLOCKED | |
### Overall Verdict
[ALL CLEAR — feature is ready to ship]
[BLOCKED — [N] checks require resolution before shipping]