owasp-security

OWASP Security Best Practices is a defensive reference skill that supplies current OWASP standards to an agent while it writes or reviews code. It targets the recurring problem that automated security review over-reports: a raw pattern match gets flagged as a vulnerability even when the sink is unreachable or already mitigated, which buries the findings that actually matter. The skill grounds review in the OWASP Top 10:2025, ASVS 5.0, the LLM Top 10 (2025), and the Agentic AI security guidance (2026), and insists a finding be confirmed as attacker-controlled input reaching a reachable sink with real blast radius before it is reported.

The core SKILL.md carries a quick-reference table of the 2025 Top 10 with key preventions, a three-step reachability test to run before reporting, and a structured code-review checklist spanning input handling, authentication and sessions, access control, data protection, and error handling. It also shows paired unsafe/safe code patterns for issues such as SQL and command injection. Two load-on-demand reference files extend it: languages.md covers per-language security quirks with unsafe/safe examples for 20-plus languages, and owasp-report.md is a deep-dive across every OWASP 2025-2026 standard including renamed and new categories.

It is aimed at developers and security reviewers who want up-to-date, exploitability-first guidance when auditing web applications, implementing auth, or handling untrusted input. Useful cases include pre-merge security review, threat-informed design discussions, and keeping references current when older category names signal stale advice.