| name | owasp-security-gate |
| description | Full pre-ship security review that runs all ten OWASP Top 10 checks in sequence. Use before any significant feature ships to production. |
| when_to_use | Use explicitly with /owasp-security-gate before merging a feature that touches authentication, data access, external requests, or configuration. Also use when asked to do a full security review. |
OWASP Security Gate (Meta-Skill)
This skill runs all ten OWASP Top 10 (2021) checks in sequence. Use it before a feature ships, before a PR is marked ready for review, or any time a full security review is needed.
Each check below maps to a dedicated skill. Run them in order. Mark each CLEAR or BLOCKED. If any check is BLOCKED, the feature does not ship until it is resolved.
Run in Sequence
A01 — Broken Access Control
Apply broken-access-control skill.
Trigger: any code that retrieves, modifies, or deletes user data.
Key questions:
- Is object-level authorization enforced? (No IDOR)
- Is the access control check server-side?
- Does access default to deny?
A02 — Cryptographic Failures
Apply cryptographic-failures skill.
Trigger: any code that stores or transmits passwords, tokens, or PII.
Key questions:
- Are passwords hashed with bcrypt, scrypt, Argon2, or PBKDF2?
- Is sensitive data encrypted at rest and in transit?
- Are there hardcoded secrets?
A03 — Injection
Apply injection-check skill.
Trigger: any code that incorporates user input into SQL, shell commands, HTML, or LDAP.
Key questions:
- Are all SQL queries parameterized?
- Does any code pass user input to a shell?
- Is HTML output escaped?
A04 — Insecure Design
Apply insecure-design skill.
Trigger: any new user-facing feature, auth flow, or data handling system.
Key questions:
- Is there a threat model?
- Are rate limits defined?
- Is the worst-case abuse scenario documented?
A05 — Security Misconfiguration
Apply security-misconfiguration skill.
Trigger: any configuration, infrastructure, or deployment code.
Key questions:
- Is debug mode off?
- Is CORS restricted to specific origins?
- Are security headers present?
A06 — Vulnerable Components
Apply vulnerable-components skill.
Trigger: any new or upgraded dependency.
Key questions:
- Are there known CVEs in this version?
- Is the license compatible?
- Is the dependency pinned?
A07 — Authentication Failures
Apply auth-failures skill.
Trigger: any login, session, token, or credential code.
Key questions:
- Is there rate limiting on login?
- Are sessions invalidated on logout?
- Is JWT configured securely?
A08 — Data Integrity Failures
Apply data-integrity-failures skill.
Trigger: any deserialization, CI pipeline, or update mechanism code.
Key questions:
- Is untrusted data deserialized with pickle or equivalent?
- Does the CI pipeline use pinned dependencies?
A09 — Security Logging Failures
Apply security-logging-failures skill.
Trigger: any authentication, authorization, or sensitive data access code.
Key questions:
- Are auth events logged with structured fields?
- Do logs contain any sensitive data (passwords, tokens)?
A10 — SSRF
Apply ssrf-check skill.
Trigger: any code that fetches a URL based on user input.
Key questions:
- Is there an allowlist of permitted hosts?
- Is the AWS metadata endpoint blocked?
Summary Report Format
After running all ten checks:
## OWASP Security Gate Report
**Feature:** [name]
**Date:** [YYYY-MM-DD]
| Check | OWASP | Status | Blocker |
|---|---|---|---|
| broken-access-control | A01 | CLEAR / BLOCKED | [issue if blocked] |
| cryptographic-failures | A02 | CLEAR / BLOCKED | |
| injection-check | A03 | CLEAR / BLOCKED | |
| insecure-design | A04 | CLEAR / BLOCKED | |
| security-misconfiguration | A05 | CLEAR / BLOCKED | |
| vulnerable-components | A06 | CLEAR / BLOCKED | |
| auth-failures | A07 | CLEAR / BLOCKED | |
| data-integrity-failures | A08 | CLEAR / BLOCKED | |
| security-logging-failures | A09 | CLEAR / BLOCKED | |
| ssrf-check | A10 | CLEAR / BLOCKED | |
### Overall Verdict
[ALL CLEAR — feature is ready to ship]
[BLOCKED — [N] checks require resolution before shipping]
