Is the Owasp Security skill free?

Yes. The skill itself is free from agamm/claude-code-owasp. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Owasp Security SkillProof Score?

8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 5/5.

How do I install Owasp Security?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Owasp Security with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Owasp Security

OWASP Top 10:2025, ASVS 5.0, and LLM/agentic security guidance for code review

by agamm · agamm/claude-code-owasp

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 8.8/10
Tested: Jul 31, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · bc4304a

Fetched SKILL.md (frontmatter has name+description); both referenced files (reference/languages.md, reference/owasp-report.md) return HTTP 200 via raw fetch. No security smells — pure defensive-security reference text, no scripts/curl|sh/base64. Trigger phrasings: SHOULD activate — "Review this Express route for security vulnerabilities", "Help me implement password hashing and session management for login", "Is my SQL query safe from injection?"; should NOT — "Write a Python function to sort dicts by date", "Set up a GitHub Actions workflow to run my tests" (all 5 judged correctly). Output test: reviewed a 28-line vulnerable Flask app two ways. Baseline flagged 4 SQL-injection findings including the /health query, which concatenates a hardcoded STATUS constant — a false positive. Following SKILL.md's "Before Reporting a Finding" rubric, the skill review excluded /health as not attacker-controlled and cited A05/A04/A07 plus ASVS 5.0 IDs; same 4 real findings, one fewer false positive.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 7/10
Docs & honesty 5/5

What Owasp Security does

A reference skill that loads OWASP Top 10:2025, ASVS 5.0, the LLM Top 10 (2025), and Agentic AI (2026) standards into context, with a false-positive triage rubric, security checklists, and unsafe/safe code patterns. Triggers when reviewing code for vulnerabilities, implementing authentication or authorization, handling user input, or discussing web application security. Ships two on-demand reference files covering 20+ languages and per-item attack vectors.

How to install Owasp Security

git clone --depth 1 https://github.com/agamm/claude-code-owasp.git /tmp/owasp-security-src
mkdir -p ~/.claude/skills
cp -R /tmp/owasp-security-src/.claude/skills/owasp-security ~/.claude/skills/owasp-security
# SKILL.md lands at ~/.claude/skills/owasp-security/SKILL.md plus reference/languages.md and reference/owasp-report.md
# Alternative (no git history): npx degit agamm/claude-code-owasp/.claude/skills/owasp-security ~/.claude/skills/owasp-security
# No external deps, API keys, or runtime — it is pure reference/guidance loaded into context.

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Owasp Security

/owasp-security OWASP Top 10:2025, ASVS 5.0, and LLM/agentic security guidance for code review

It also activates on plain-language prompts like these:

Review this auth flow for OWASP vulnerabilities
Check this input handling against ASVS 5.0
Assess this agent for LLM Top 10 risks

Frequently asked questions

Is the Owasp Security skill free?: Yes. The skill itself is free from agamm/claude-code-owasp. SkillProof publishes the install command and an independent test verdict at no cost.
Does Owasp Security work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 31, 2026. Verdict: Tested · Works. Fetched SKILL.md (frontmatter has name+description); both referenced files (reference/languages.md, reference/owasp-report.md) return HTTP 200 via raw fetch. No security smells — pure defensive-security reference text, no scripts/curl|sh/base64. Trigger phrasings: SHOULD activate — "Review this Express route for security vulnerabilities", "Help me implement password hashing and session management for login", "Is my SQL query safe from injection?"; should NOT — "Write a Python function to sort dicts by date", "Set up a GitHub Actions workflow to run my tests" (all 5 judged correctly). Output test: reviewed a 28-line vulnerable Flask app two ways. Baseline flagged 4 SQL-injection findings including the /health query, which concatenates a hardcoded STATUS constant — a false positive. Following SKILL.md's "Before Reporting a Finding" rubric, the skill review excluded /health as not attacker-controlled and cited A05/A04/A07 plus ASVS 5.0 IDs; same 4 real findings, one fewer false positive.
What is the Owasp Security SkillProof Score?: 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 5/5.
How do I install Owasp Security?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Owasp Security with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.