Menü
Use when: reviewing code for OWASP Top 10:2025 security findings with severity classification and a structured output format.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Use when running workspace tests, choosing a test command, or summarizing results before handoff to debugger.
Use when running workspace tests, choosing a test command, or summarizing results before handoff to debugger.
Use when: running pre-commit or pre-push CI-equivalent checks in any workspace — discovers workflow commands with Cursor tools, filters for local executability, scopes to staged changes, and runs checks cheapest-first.
Use when the user wants to install or customize cursorAssistant in the current project (GitHub install or configure).
Use when: running pre-commit or pre-push CI-equivalent checks in any workspace — discovers workflow commands with Cursor tools, filters for local executability, scopes to staged changes, and runs checks cheapest-first.
Use when: discovering package manifests, assessing dependency health, finding replacements, or confirming import usage before removal — discovery only; mutating installs are handled by the deps agent.
| name | secureReview |
| description | Use when: reviewing code for OWASP Top 10:2025 security findings with severity classification and a structured output format. |
| type | reference |
| version | 1.0 |
| license | MIT |
Skill metadata: version "1.0"; tags [security, owasp, review]; recommended tools [].
Use this skill in workspaces with the secure pack selected.
Perform security-focused code review against the OWASP Top 10:2025. For each finding, map it to a specific OWASP category.
devopsReviewdependencyAudit| ID | Category | Common patterns to look for |
|---|---|---|
| A01 | Broken Access Control | Missing authorization checks, IDOR, path traversal, privilege escalation |
| A02 | Security Misconfiguration | Default credentials, overly permissive CORS, debug endpoints in production, unnecessary features enabled |
| A03 | Software Supply Chain Failures | Unpinned dependencies, unsigned artifacts, build system trust issues |
| A04 | Cryptographic Failures | Plaintext sensitive data, weak algorithms (MD5/SHA1 for secrets), hardcoded keys, insufficient key length |
| A05 | Injection | SQL injection, command injection, LDAP injection, template injection, XSS |
| A06 | Insecure Design | Missing rate limiting, no fraud controls, unsafe business logic, design decisions that assume trust |
| A07 | Authentication Failures | Weak password policy, missing MFA, session fixation, predictable session tokens |
| A08 | Software or Data Integrity Failures | Deserialization of untrusted data, unsigned updates, missing integrity checks |
| A09 | Security Logging and Alerting Failures | No audit trail, logging sensitive data, no alerting on critical events |
| A10 | Mishandling of Exceptional Conditions | Stack traces exposed to users, unsafe exception paths, resource leaks on error |
Produce a table for every code review:
| Severity | OWASP | File:Line | Finding | Recommended fix |
|---|
When writing new code (not reviewing), apply these without annotation unless they expand scope:
Do not report findings that are purely stylistic, have no security relevance, or require access to runtime configuration you cannot see. Speculation is not a finding.
Use these prefixes when giving code review feedback:
critical: — Critical severity finding (A01–A10)high: — High severity findingmedium: — Medium severity findinglow: — Low severity finding, accepted risk, or informationalnit: — Style or formatting issue with no security relevance