菜单
Comprehensive OWASP Cheat Sheet Series skill providing direct access to all OWASP cheat sheets for web application security, secure coding practices, and vulnerability prevention. Use when working on authentication, authorization, injection prevention, cryptography, or any OWASP-related security guidance.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants. Profiles the OAuth Assertion Framework (RFC 7521) to define (1) the jwt-bearer authorization grant for requesting an access token from an existing trust relationship without a user-approval step, and (2) JWT-based client authentication at the token endpoint via client_assertion. The basis for the private_key_jwt client authentication method. Use when implementing or validating signed JWT assertions for OAuth token requests, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, or iss/sub/aud/exp claim validation.
OpenID Connect Discovery 1.0 - Defines mechanism for Relying Party to discover OpenID Provider and obtain OAuth 2.0 endpoint locations. Covers Issuer Discovery, Provider Metadata, and Configuration Information retrieval. Use when working with OpenID Provider discovery, well-known endpoints, or metadata configuration.
OpenID Connect Core 1.0 - Identity layer on top of OAuth 2.0 protocol. Defines ID Token, UserInfo endpoint, authentication flows (Authorization Code, Implicit, Hybrid), claims, and standard claims for identity. Use when working with OpenID Connect authentication, identity tokens, user profile information, or OAuth 2.0 extensions for identity.
RFC 6749: The OAuth 2.0 Authorization Framework. Defines the protocol for third-party application access to HTTP services on behalf of a resource owner, introducing authorization layers, access tokens, and refresh tokens. Replaces OAuth 1.0 (RFC 5849).
RFC 7636: Proof Key for Code Exchange by OAuth Public Clients. Defines PKCE extension for OAuth 2.0 Authorization Code flow, mitigating authorization code interception attacks by introducing code_verifier and code_challenge parameters. Enables secure OAuth usage for public clients like mobile apps and SPAs.
Web Authentication Level 2 (WebAuthn) - W3C specification defining an API for strong, attested, scoped public key-based credentials. Enables passwordless authentication and phishing-resistant MFA using platform or roaming authenticators. Use when working with WebAuthn API, FIDO2, public key credentials, or browser-based authentication.
| name | owasp-cheatsheets |
| description | Comprehensive OWASP Cheat Sheet Series skill providing direct access to all OWASP cheat sheets for web application security, secure coding practices, and vulnerability prevention. Use when working on authentication, authorization, injection prevention, cryptography, or any OWASP-related security guidance. |
| license | CC-BY-SA-4.0 |
| metadata | {"author":"OWASP","version":"1.0","source":"https://github.com/OWASP/CheatSheetSeries","categories":"authentication, authorization, injection, xss, csrf, cryptography, security, owasp"} |
| compatibility | Works with any agent or LLM. No special tools required. Requires internet access to fetch remote cheat sheets. |
This skill provides direct access to the OWASP Cheat Sheet Series, a collection of concise, actionable security guidance for developers, architects, and security professionals. All content is fetched from the official OWASP repository.
Use this skill when:
| Task | Cheat Sheet |
|---|---|
| Secure authentication implementation | Authentication Cheat Sheet |
| Password storage best practices | Password Storage Cheat Sheet |
| Session management security | Session Management Cheat Sheet |
| SQL injection prevention | SQL Injection Prevention Cheat Sheet |
| Cross-site scripting (XSS) prevention | XSS Prevention Cheat Sheet |
| CSRF prevention | CSRF Prevention Cheat Sheet |
| Input validation | Input Validation Cheat Sheet |
| Cryptographic storage | Cryptographic Storage Cheat Sheet |
The OWASP Cheat Sheet Series is organized into the following categories:
All aspects of user identity verification, access control, and session management.
Cheat Sheets:
Preventing all forms of injection attacks across different technologies.
Cheat Sheets:
Securing data at rest, in transit, and during processing.
Cheat Sheets:
General application security principles and practices.
Cheat Sheets:
Securing the infrastructure and deployment pipeline.
Cheat Sheets:
Security guidance for specific frameworks and languages.
Cheat Sheets:
Security for modern and emerging technologies.
Cheat Sheets:
Niche but important security areas.
Cheat Sheets:
1. User provides credentials (username/password)
2. Validate input (Input Validation Cheat Sheet)
3. Verify password securely (Password Storage Cheat Sheet)
4. Create session (Session Management Cheat Sheet)
5. Set secure cookies (Cookie Theft Mitigation Cheat Sheet)
6. Implement MFA if required (Multifactor Authentication Cheat Sheet)
1. Receive user input
2. Validate all input (Input Validation Cheat Sheet)
3. Use parameterized queries (SQL Injection Prevention Cheat Sheet)
4. Encode output (XSS Prevention Cheat Sheet)
5. Log access appropriately (Logging Cheat Sheet)
The cheat sheets align with the OWASP Top 10 vulnerabilities:
| OWASP Top 10 | Relevant Cheat Sheets |
|---|---|
| A01:2021 - Broken Access Control | Access Control, Authorization, Insecure Direct Object Reference Prevention |
| A02:2021 - Cryptographic Failures | Cryptographic Storage, Password Storage, TLS Cipher String |
| A03:2021 - Injection | SQL Injection Prevention, XSS Prevention, OS Command Injection, LDAP Injection, Deserialization |
| A04:2021 - Insecure Design | Secure Product Design, Business Logic Security, Attack Surface Analysis |
| A05:2021 - Security Misconfiguration | HTTP Headers, Content Security Policy, Secure Cloud Architecture |
| A06:2021 - Vulnerable and Outdated Components | Dependency Graph SBOM, Software Supply Chain Security |
| A07:2021 - Identification and Authentication Failures | Authentication, Password Storage, Session Management, Multifactor Authentication |
| A08:2021 - Software and Data Integrity Failures | Input Validation, File Upload, Deserialization |
| A09:2021 - Security Logging and Monitoring Failures | Logging, Logging Vocabulary |
| A10:2021 - Server-Side Request Forgery | SSRF Prevention |
For a complete, searchable list of all cheat sheets, visit:
All content is sourced from the OWASP Cheat Sheet Series repository, licensed under CC-BY-SA-4.0.
For the most up-to-date information, always refer to the official OWASP repository.