OWASP Security Skill for Claude Code

A Claude Code skill providing the latest OWASP security best practices (2025-2026) for developers building secure applications.

Quick Install

Install as a Claude Code plugin:

/plugin marketplace add agamm/claude-code-owasp
/plugin install owasp-security@agamm

Updating

Third-party marketplaces don't auto-update by default. Either update by hand:

claude plugin marketplace update agamm
claude plugin update owasp-security@agamm

or turn on auto-update once: run /plugin, open the Marketplaces tab, select agamm, and choose Enable auto-update. Updates apply to the next session, or run /reload-plugins.

Install as a plain skill

The skill is a directory (SKILL.md plus on-demand reference/ files), so install the whole folder. The easiest way is degit, which copies a GitHub subdirectory without the .git history:

npx degit agamm/claude-code-owasp/.claude/skills/owasp-security .claude/skills/owasp-security

Or install globally for all projects:

npx degit agamm/claude-code-owasp/.claude/skills/owasp-security ~/.claude/skills/owasp-security

What's Included

Claude Code Skill

Location: .claude/skills/owasp-security/

SKILL.md (loaded when the skill triggers):

• Security review workflow - a five-step checklist from entry points to report
• Finding-triage rubric - confirm attacker-controlled input, sink reachability, and blast radius before reporting, to cut false positives
• Reporting format - fixed finding structure (location, input-to-sink path, impact, fix, confidence) with severity rated by exploitability
• OWASP Top 10:2025 quick reference table
• OWASP Top 10 for LLM Applications (2026) - LLM01-LLM10 risks for chatbots, RAG, and tool-calling apps
• OWASP Agentic AI Security (2026) - ASI01-ASI10 risks for AI agent systems
• ASVS 5.0 key requirements with real 5.0 requirement IDs and levels

reference/ (loaded on demand, following Claude Code progressive-disclosure best practices):

• review-checklist.md - coverage checklist for every Top 10 category (including SSRF, file handling, JWTs, CORS, and CSRF) plus LLM and agent features
• languages.md - language-specific security quirks for 20+ languages with unsafe/safe examples
• config-and-supply-chain.md - A02 and A03 where they actually live: Dockerfiles, Kubernetes, Terraform, framework config, security headers, lockfiles, dependency confusion, install scripts, and CI/CD workflows
• owasp-report.md - deep-dive on the Top 10:2025, ASVS 5.0, the LLM Top 10 (2026), and the Agentic list (2026), with per-item attack vectors and mitigations

Accuracy

Category names, ASVS chapter structure, and ASVS requirement IDs and levels are verified directly against owasp.org/Top10/2025, github.com/OWASP/ASVS, and the LLM Top 10 2026 PDF rather than paraphrased. The Agentic Top 10 names are checked against that PDF's framework-mapping appendix.