owasp-reference

name	owasp-reference
description	Look up and map to the right OWASP Top 10 family — Web, API, LLM, or Mobile — and give the canonical category ID/name for a finding. Use when you need a consistent OWASP reference for tagging findings, scoping a review, or aligning a report across the appsec/genai plugins.

Goal

The correct OWASP family and category for a finding or scope, cited consistently — so reviews and reports across web, API, LLM, and mobile work line up.

Steps

1. Pick the right list by the asset under review:
   • Web app → OWASP Web Top 10 (2021)
   • REST/GraphQL API → OWASP API Security Top 10 (2023)
   • LLM/GenAI feature → OWASP Top 10 for LLM Applications (2025)
   • Mobile app → OWASP Mobile Top 10 (2024) + MASVS/MASTG
2. Map the finding to the closest category; cite ID + name (e.g., A01:2021 – Broken Access Control, API1:2023 – BOLA, LLM01 – Prompt Injection). See reference.md for all four lists.
3. Hand off to the deep skill — the family plugins own the actual testing methodology (web-app-security, api-security, llm-security, mobile-security); this skill is the consistent reference/tagging layer.

Output

The family + category ID/name, a one-line rationale, and a pointer to the relevant testing skill. For multi-category findings, list each with the primary one first.

Notes

OWASP lists are versioned and renumber between editions — always cite the year/edition (A01:2021, API1:2023, LLM01:2025). Don't force a finding into a category it doesn't fit; "doesn't map cleanly" is a valid, useful answer. See reference.md for the full category lists.