claude-code-owasp

Name: claude-code-owasp
Author: agamm

Verified

Claude Code skill for OWASP security best practices (2025-2026). Includes Top 10:2025, ASVS 5.0, Agentic AI security, and 20+ language-specific security quirks.

333stars

30forks

Added 4/9/2026

Installation

# Add to your Claude Code skills
git clone https://github.com/agamm/claude-code-owasp

Getting Started

Guides for using ai agents skills like claude-code-owasp.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportVerified

Last scanned: 5/30/2026

{
  "issues": [],
  "status": "PASSED",
  "scannedAt": "2026-05-30T15:34:22.466Z",
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Frequently Asked Questions

What is claude-code-owasp?

claude-code-owasp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by agamm. Claude Code skill for OWASP security best practices (2025-2026). Includes Top 10:2025, ASVS 5.0, Agentic AI security, and 20+ language-specific security quirks. It has 333 GitHub stars.

Is claude-code-owasp safe to use?

Yes. claude-code-owasp passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.

How do I install claude-code-owasp?

Clone the repository with "git clone https://github.com/agamm/claude-code-owasp" and add it to your Claude Code skills directory (see the Installation section above).

Are there alternatives to claude-code-owasp?

Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh claude-code-owasp against similar tools.

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

242,622

Hermes-Studio Open-AI-Design-Agent

⚠️ Third-Party Software Notice

This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.

Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.

Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.

Read the Terms of Service

OWASP Security Skill for Claude Code

A Claude Code skill providing the latest OWASP security best practices (2025-2026) for developers building secure applications.

Quick Install

The skill is a directory (SKILL.md plus on-demand reference/ files), so install the whole folder. The easiest way is degit, which copies a GitHub subdirectory without the .git history:

npx degit agamm/claude-code-owasp/.claude/skills/owasp-security .claude/skills/owasp-security

Or install globally for all projects:

npx degit agamm/claude-code-owasp/.claude/skills/owasp-security ~/.claude/skills/owasp-security

What's Included

Claude Code Skill

Location: .claude/skills/owasp-security/

SKILL.md (the always-loaded core):

OWASP Top 10:2025 quick reference table
Finding-triage rubric - confirm attacker-controlled input, sink reachability, and blast radius before reporting, to cut false positives
Security code review checklists for input handling, auth, access control, data protection, and error handling
Secure code patterns with unsafe/safe examples
OWASP Top 10 for LLM Applications (2025) - LLM01-LLM10 risks for chatbots, RAG, and tool-calling apps
OWASP Agentic AI Security (2026) - ASI01-ASI10 risks for AI agent systems
ASVS 5.0 key requirements with real 5.0 requirement IDs and levels
Deep security analysis mindset for any language

reference/ (loaded on demand, following Claude Code progressive-disclosure best practices):

languages.md - language-specific security quirks for 20+ languages with unsafe/safe examples
owasp-report.md - deep-dive on the Top 10:2025, ASVS 5.0, the LLM Top 10 (2025), and the Agentic list (2026), with per-item attack vectors and mitigations

Accuracy

Category names, ASVS chapter structure, and ASVS requirement IDs and levels are verified directly against owasp.org/Top10/2025, github.com/OWASP/ASVS, and genai.owasp.org rather than paraphrased.

This matters more than it sounds: ASVS 5.0 renumbered every chapter, so 4.0 requirement IDs do not carry over, and three Top 10 categories were renamed in 2025. Much of the OWASP material circulating online still cites the old IDs and names.

Usage

Once installed, Claude Code automatically activates this skill when you:

Review code for security vulnerabilities
Implement authentication or authorization
Handle user input or external data
Work with cryptography or password storage
Design API endpoints
Build AI agent systems

Example Prompts

"Review this code for security issues"
"Is this authentication implementation secure?"
"What are the security risks in this Python code?"
"Help me implement secure session management"
"Check this AI agent for OWASP agentic risks"

Covered Standards

Standard	Version	Focus
OWASP Top 10	2025	Web application vulnerabilities
OWASP ASVS	5.0.0	Security verification requirements
OWASP Top 10 for LLM Apps	2025	LLM/RAG/tool-calling app risks
OWASP Agentic	2026	AI agent security risks

Language Coverage

Security quirks for 20+ languages including:

Web	Systems	Mobile	Scripting
JavaScript/TypeScript	C/C++	Swift	Python
PHP	Rust	Kotlin	Ruby
Java	Go	Dart	Perl
C#			Shell

Each language section includes common vulnerabilities, unsafe/safe code patterns, and key functions to watch for.

Alternative Installation

Clone Full Repository

git clone https://github.com/agamm/claude-code-owasp.git
cp -r claude-code-owasp/.claude/skills/owasp-security YOUR_PROJECT/.claude/skills/

Contributing

Contributions welcome! Please:

Fork the repository
Create a feature branch
Submit a pull request

Sources

OWASP Top 10:2025
OWASP ASVS 5.0 — chapter files, one per V-number
OWASP Top 10 for LLM Applications 2025
OWASP GenAI Security Project — home of the LLM and Agentic lists
OWASP Cheat Sheet Series

License

MIT License - See LICENSE file for details.

Keywords: OWASP, security, Claude Code, AI security, application security, ASVS, secure coding, vulnerability, injection, XSS, CSRF, authentication, authorization