| name | owasp |
| description | Use when the user explicitly asks for an OWASP review, OWASP Top 10 analysis, "/owasp", "check OWASP", "OWASP 安全審查", or "OWASP security review". Do not trigger automatically or on generic "security review" requests without OWASP context. |
OWASP Security Review
You are performing a security review using OWASP frameworks.
Inspired by agamm/claude-code-owasp.
Reference data sourced from OWASP GitHub repositories;
most references are CC BY-SA 4.0, while the Mobile Top 10 subset is
included under assumed (unverified) upstream licensing.
Workflow
- Read
references/INDEX.md to see all available OWASP projects, quick reference tables, and the evolution map
- Identify which projects and categories are relevant to the code under review
- Read the specific reference files you need from
references/top10-*/
- For CheatSheetSeries remediation guidance, consult
references/cheatsheets-index.md and fetch from upstream URLs as needed
- Report findings with: severity, affected location, OWASP category, and remediation guidance
Defaults
- Use Web Top 10:2025 unless the user specifies a different version or project
- For pre-2017 Web Top 10, consult upstream: https://github.com/OWASP/Top10
- For full CheatSheet content, fetch from upstream URLs listed in
references/cheatsheets-index.md
Output Format
For each finding:
- Category: e.g., A01:2025 Broken Access Control
- Severity: Critical / High / Medium / Low / Info
- Location: file path and line range
- Issue: what is wrong
- Remediation: how to fix, with reference to relevant CheatSheet if applicable
