메뉴
Verify compliance with OWASP Top 10 2021 security standards. Use when performing OWASP compliance checks and security certification.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Analyze feature requirements, dependencies, and security considerations. Use when starting feature implementation from GitHub issues to understand scope, technical feasibility, and risks.
Design system architecture, API contracts, and data flows. Use when translating analyzed requirements into technical design for feature implementation.
Implement features with code, tests, and documentation. Use when building features from approved designs following TDD and project coding standards.
Validate code quality, test coverage, performance, and security. Use when verifying implemented features meet all standards and requirements before marking complete.
Validate WCAG 2.1 Level AA compliance and accessibility best practices. Use when performing accessibility audits and WCAG certification.
Analyze feature requirements, dependencies, and security considerations. Use when starting feature implementation from GitHub issues to understand scope, technical feasibility, and risks.
| name | owasp-checker |
| description | Verify compliance with OWASP Top 10 2021 security standards. Use when performing OWASP compliance checks and security certification. |
| allowed-tools | Read, Grep, Glob, Bash |
This skill provides systematic verification of application compliance with the OWASP Top 10 2021 security standards, ensuring comprehensive security coverage across all critical categories.
Risk: Users can act outside of their intended permissions
Compliance Checks:
1. Authorization Enforcement:
# Check for authorization decorators/middleware
grep -r "@requires_auth\|@login_required\|@permission_required" src/
grep -r "auth_required\|check_permission" src/
# Find routes without authorization
grep -r "@app.route\|@router.get\|@router.post" src/ --include="*.py" -A 5
Checklist:
2. Insecure Direct Object References (IDOR):
# Look for direct ID usage from requests
grep -r "request.*\['id'\]\|request.*\.id\|params\['id'\]" src/
Checklist:
3. CORS Configuration:
# Check CORS settings
grep -r "Access-Control-Allow-Origin" src/ config/
grep -r "CORS.*origin" src/ --include="*.py" --include="*.js"
Checklist:
4. Disable Directory Listing:
# Check web server config
grep -r "autoindex\|directory.*listing" config/
Checklist:
Status: ☐ Pass ☐ Fail
Risk: Sensitive data exposed due to weak or missing encryption
Compliance Checks:
1. Data in Transit:
# Check TLS enforcement
grep -r "SECURE_SSL_REDIRECT\|HTTPS_ONLY\|ssl.*required" config/ src/
grep -r "tls.*version\|ssl.*version" config/
# Check for HTTP usage
grep -r "http://\|ws://" src/ | grep -v "localhost\|127.0.0.1"
Checklist:
2. Data at Rest:
# Check for encryption of sensitive data
grep -r "encrypt\|cipher\|AES" src/
grep -r "password.*plain\|password.*clear" src/
Checklist:
3. Weak Cryptography:
# Find weak algorithms
grep -r "md5\|sha1\|DES\|RC4" src/ --include="*.py" --include="*.js"
grep -r "ECB.*mode" src/
Checklist:
4. Random Number Generation:
# Check RNG usage
grep -r "random\.random\|Math\.random" src/
grep -r "secrets\|os\.urandom\|crypto\.randomBytes" src/
Checklist:
Status: ☐ Pass ☐ Fail
Risk: Untrusted data sent to interpreter as command/query
Compliance Checks:
1. SQL Injection Prevention:
# Find string concatenation in SQL
grep -r "execute.*%\|execute.*\+\|execute.*format\|execute.*f\"" src/ --include="*.py"
grep -r "SELECT.*\+\|INSERT.*\+\|UPDATE.*\+\|DELETE.*\+" src/
Checklist:
2. Command Injection Prevention:
# Find shell command execution
grep -r "subprocess.*shell=True\|os\.system\|os\.popen" src/ --include="*.py"
grep -r "exec\|eval\|child_process" src/ --include="*.js"
Checklist:
3. LDAP Injection:
grep -r "ldap.*search\|ldap.*filter" src/
Checklist:
4. NoSQL Injection:
grep -r "find.*\$where\|\.exec(" src/ --include="*.js"
Checklist:
5. Template Injection:
grep -r "render_template_string\|Jinja2.*from_string" src/
grep -r "autoescape.*False" src/
Checklist:
Status: ☐ Pass ☐ Fail
Risk: Missing or ineffective security controls in design
Compliance Checks:
1. Threat Modeling:
Checklist:
2. Security Design Patterns:
Checklist:
3. Rate Limiting:
grep -r "rate.*limit\|throttle" src/ config/
Checklist:
4. Business Logic:
Checklist:
Status: ☐ Pass ☐ Fail
Risk: Insecure default configurations, incomplete setups
Compliance Checks:
1. Security Headers:
# Check for security headers
grep -r "X-Frame-Options\|X-Content-Type-Options\|Content-Security-Policy" src/ config/
grep -r "Strict-Transport-Security\|X-XSS-Protection" src/ config/
Checklist:
2. Error Handling:
# Check debug mode
grep -r "DEBUG.*True\|development.*mode" config/ src/
grep -r "traceback\|stack.*trace" src/
Checklist:
3. Default Credentials:
# Find hardcoded credentials
grep -r "password.*=.*admin\|password.*=.*password" src/ config/
Checklist:
4. Unnecessary Features:
# Check for sample/test code
find . -name "*sample*" -o -name "*test*" -o -name "*demo*" | grep -v node_modules
Checklist:
5. Missing Patches:
# Check dependency status
pip list --outdated 2>/dev/null || npm outdated 2>/dev/null
Checklist:
Status: ☐ Pass ☐ Fail
Risk: Using components with known vulnerabilities
Compliance Checks:
1. Dependency Inventory:
# List all dependencies
pip list --format=json > dependencies.json 2>/dev/null || npm list --json > dependencies.json 2>/dev/null
Checklist:
2. Vulnerability Scanning:
# Scan for vulnerabilities
pip-audit --format json 2>/dev/null || npm audit --json 2>/dev/null
safety check --json 2>/dev/null
Checklist:
3. Version Management:
# Check for version pinning
cat requirements.txt setup.py package.json 2>/dev/null
Checklist:
4. Component Retirement:
Checklist:
Status: ☐ Pass ☐ Fail
Risk: Weak authentication allows impersonation
Compliance Checks:
1. Password Policy:
# Check password requirements
grep -r "password.*length\|password.*complexity" src/
grep -r "MIN_PASSWORD_LENGTH\|PASSWORD_VALIDATORS" config/ src/
Checklist:
2. Multi-Factor Authentication:
grep -r "mfa\|2fa\|totp\|two.*factor" src/
Checklist:
3. Session Management:
# Check session configuration
grep -r "SESSION.*TIMEOUT\|session.*expir" config/ src/
grep -r "SESSION_COOKIE_SECURE\|SESSION_COOKIE_HTTPONLY" config/ src/
Checklist:
4. Credential Storage:
# Check password hashing
grep -r "bcrypt\|argon2\|scrypt\|pbkdf2" src/
grep -r "hashlib\.md5.*password\|hashlib\.sha1.*password" src/
Checklist:
5. Account Enumeration:
# Check error messages
grep -r "user.*not.*found\|invalid.*username" src/
Checklist:
6. Brute Force Protection:
grep -r "login.*attempt\|failed.*attempt\|account.*lock" src/
Checklist:
Status: ☐ Pass ☐ Fail
Risk: Code and infrastructure not protected from integrity violations
Compliance Checks:
1. Insecure Deserialization:
# Check for unsafe deserialization
grep -r "pickle\.loads\|yaml\.load\(" src/ --include="*.py"
grep -r "eval\|unserialize" src/
Checklist:
2. CI/CD Pipeline Security:
Checklist:
3. Update Mechanism:
Checklist:
4. Supply Chain Security:
Checklist:
Status: ☐ Pass ☐ Fail
Risk: Breaches not detected, incidents not responded to
Compliance Checks:
1. Security Event Logging:
# Check logging implementation
grep -r "logging\|logger\|log\." src/ --include="*.py" --include="*.js"
grep -r "audit.*log\|security.*log" src/
Checklist:
2. Log Content:
Checklist:
3. Log Protection:
# Check log file permissions
find . -name "*.log" -ls 2>/dev/null
Checklist:
4. Monitoring and Alerting:
Checklist:
5. Incident Response:
Checklist:
Status: ☐ Pass ☐ Fail
Risk: Application fetches remote resources without validating user-supplied URL
Compliance Checks:
1. URL Validation:
# Find URL fetching code
grep -r "requests\.get\|urllib\.request\|fetch\|axios\.get" src/
grep -r "url.*request\|user.*url" src/
Checklist:
2. Network Segmentation:
Checklist:
3. Input Validation:
# Check for URL sanitization
grep -r "validate.*url\|sanitize.*url\|parse.*url" src/
Checklist:
Status: ☐ Pass ☐ Fail
# OWASP Top 10 2021 Compliance Report
**Date**: [YYYY-MM-DD]
**Application**: [name]
**Assessed By**: OWASP Checker
## Compliance Summary
| Category | Status | Critical Issues | Notes |
|----------|--------|-----------------|-------|
| A01 - Broken Access Control | ✅/⚠️/❌ | [count] | [summary] |
| A02 - Cryptographic Failures | ✅/⚠️/❌ | [count] | [summary] |
| A03 - Injection | ✅/⚠️/❌ | [count] | [summary] |
| A04 - Insecure Design | ✅/⚠️/❌ | [count] | [summary] |
| A05 - Security Misconfiguration | ✅/⚠️/❌ | [count] | [summary] |
| A06 - Vulnerable Components | ✅/⚠️/❌ | [count] | [summary] |
| A07 - Auth Failures | ✅/⚠️/❌ | [count] | [summary] |
| A08 - Integrity Failures | ✅/⚠️/❌ | [count] | [summary] |
| A09 - Logging Failures | ✅/⚠️/❌ | [count] | [summary] |
| A10 - SSRF | ✅/⚠️/❌ | [count] | [summary] |
**Legend**:
- ✅ Pass: Fully compliant
- ⚠️ Partial: Some issues, not critical
- ❌ Fail: Critical issues found
**Overall Compliance**: [XX]% ([X]/10 categories passed)
## Critical Findings
[List all critical non-compliance items that must be fixed]
## Recommendations
### Immediate (Critical)
1. [Item]
### Short-term (High)
1. [Item]
### Long-term (Medium)
1. [Item]
## Certification
This application [IS / IS NOT] compliant with OWASP Top 10 2021 standards.
**Assessor**: [name]
**Date**: [YYYY-MM-DD]
**Next Assessment**: [YYYY-MM-DD]
Assessment Process:
Compliance Tracking:
Remediation:
Documentation:
Input: Implemented and tested application Process: Systematic OWASP Top 10 compliance verification Output: Compliance report with certification status Next Step: Security certification or deployment approval
Your goal is to ensure applications meet OWASP Top 10 security standards and maintain compliance over time.