owasp-security-review

name	owasp-security-review
description	OWASP-based security review skill. Detects project tech stack and loads relevant condensed OWASP cheat sheet references for in-depth security audit. Use with the security-reviewer agent for parallel multi-agent audits, or standalone for focused reviews.
origin	MCC

OWASP Security Review

This skill provides condensed, actionable OWASP security guidance organized by technology stack. It powers the security-reviewer agent's parallel audit workflow.

How It Works

1. Detect the project's tech stack from file markers and imports
2. Load only the relevant reference files (always _universal.md + stack-specific files)
3. Review the codebase against every check in the loaded references
4. Report findings with severity, file paths, and fix recommendations

Activation

This skill activates when:

• Running a security review or audit
• The security-reviewer agent is invoked
• User asks for OWASP-based security checks
• Pre-merge security gate on security-sensitive code

Stack Detection → Reference File Mapping

Project Signal	Reference File	Content Scope
Always	_universal.md	35 cross-cutting OWASP cheat sheets: auth, authz, session mgmt, MFA, input validation, crypto, secrets, injection, SSRF, IDOR, CSRF, XSS, headers, TLS, DoS, deserialization, etc.
Java / Maven / Gradle	lang-java.md	Java Security, JAAS, Bean Validation, JWT for Java, Java Injection Prevention, XXE, SQL injection, deserialization, LDAP injection
Python / pip / pyproject	lang-python.md	Django Security, DRF, Serverless/Lambda, LLM Prompt Injection, XXE, deserialization, NoSQL
.NET / C# / NuGet	lang-dotnet.md	DotNet Security, gRPC, CSRF, session, XXE, SQL injection, LDAP injection, pinning, error handling
PHP / Composer	lang-php.md	PHP Configuration, Laravel, Symfony, CSRF, XXE, SQL injection, deserialization, file upload, SAML
Ruby / Bundler	lang-ruby.md	Ruby on Rails, CSRF, mass assignment, SQL injection, IDOR, crypto, vulnerable deps
Node.js / npm / yarn / bun	lang-nodejs.md	Node.js Security, NPM Security, NodeJS Docker, Prototype Pollution, mass assignment, CSRF, NoSQL
Go / go.mod	lang-go.md	Crypto, gRPC, WebSocket, payment gateways, unvalidated redirects, Kubernetes Go client, NoSQL
Rust / Cargo	lang-rust.md	SQL injection, query parameterization, unvalidated redirects (Actix), crypto
C / C++ / CMake	lang-c-cpp.md	Toolchain hardening, compiler flags, buffer overflow, format strings, XXE (libxml2/Xerces-C), XML Security
Spring / Spring Boot	fw-spring.md	Bean Validation, CSRF, mass assignment, WebSocket, gRPC, XSS, XXE, microservices, NoSQL, error handling
Django / DRF	fw-django.md	Django Security + DRF, CSRF, XSS, SQL injection, clickjacking, CORS, session, auth
Express / NestJS	fw-express.md	Node.js Security, CSRF, HTTP headers, mass assignment, Docker, microservices
ASP.NET	fw-aspnet.md	DotNet Security, CSRF, session, file upload, error handling, XXE, gRPC, AJAX
Dockerfile / docker-compose	infra-docker.md	Image hardening, multi-stage builds, rootless, secrets, health checks, scanning
Kubernetes / Helm	infra-kubernetes.md	RBAC, network policies, pod security, secrets, admission controllers, Helm, supply chain
AWS / Azure / GCP / Lambda	infra-cloud.md	IAM, encryption at rest, VPC, Lambda hardening, subdomain takeover
CI/CD pipelines	infra-cicd.md	Pipeline hardening, SBOM, artifact signing, supply chain, IaC security, dependency management
Database config / migrations	infra-database.md	Per-engine hardening (Postgres, MySQL, MSSQL, Mongo, Redis), least-privilege, RLS, multi-tenant isolation
REST endpoints	api-rest.md	REST Security + REST Assessment
GraphQL schema	api-graphql.md	Query depth, batching, introspection, per-field authz
gRPC / Protobuf	api-grpc.md	mTLS, interceptors, deadline propagation
WebSocket handlers	api-websocket.md	Origin validation, auth, rate limiting
SOAP / WSDL	api-soap.md	Schema validation, XML DoS, WS-Security, WSDL exposure, XML signature wrapping
LLM / AI / MCP	domain-ai.md	Agent security, prompt injection, model ops, MCP security
Frontend SPA	domain-web-frontend.md	XSS, DOM XSS, DOM clobbering, CSP, clickjacking, AJAX, HTML5, CSS, third-party JS, XS-Leaks
Mobile app	domain-mobile.md	Secure storage, certificate pinning, root detection, WebView, deep links, biometric auth

Reference File Format

Each reference file in references/ follows this structure:

# [Topic] Security Review Guide
> Sources: [list of OWASP cheat sheets condensed here]

## Quick Checklist
- [ ] Check 1
- [ ] Check 2

## [Sub-topic]
**Risk**: What goes wrong
**Check**: What to look for in code
**Fix**: Recommended pattern + code snippet

Every check is actionable — something a reviewer can grep for, read, or verify in actual code.

Usage Patterns

Pattern 1: Full Parallel Audit (via security-reviewer agent)

The security-reviewer agent uses this skill automatically:

1. Detects stack
2. Reads relevant reference files
3. Launches parallel sub-agents — one per reference file
4. Each sub-agent audits the codebase against its reference checklist
5. Results are deduplicated and aggregated into a final report

This is the recommended approach for comprehensive security reviews.

Pattern 2: Focused Single-Stack Review

Load a specific reference file for targeted review:

Read skills/owasp-security-review/references/lang-nodejs.md
Then audit src/ against every check in that file.

Pattern 3: Pre-Commit Gate

Before committing security-sensitive code:

1. Load _universal.md
2. Load the language-specific reference for the changed files
3. Run checks against the diff only (git diff --staged)

Priority Rules

When more than 6 reference files match the stack:

1. _universal.md (always)
2. Language file (primary language)
3. Framework file (if detected)
4. API protocol file (if endpoints found)
5. Infrastructure files (if configs found)
6. Domain files (if applicable)

Cap at 5-6 loaded files to keep each sub-agent focused and context useful.

Integration with Agents

Agent	Role
security-reviewer	Orchestrator — detects stack, spawns parallel sub-agents, aggregates results
Sub-agents (spawned)	Specialists — each audits against one reference file
code-reviewer	Can invoke this skill for the security portion of a general code review

Severity Levels

Level	Meaning	Action
CRITICAL	Security vulnerability, data loss, RCE	BLOCK — must fix before merge
HIGH	Significant security weakness	WARN — should fix before merge
MEDIUM	Defense-in-depth gap	INFO — consider fixing
LOW	Hardening suggestion	NOTE — optional