What version of OWASP does this skill support?

This skill is specifically designed to cover all categories in the OWASP Top 10 (2021) framework.

Can it suggest fixes for found vulnerabilities?

Yes, by using the --fix flag, each subagent will produce inline remediation suggestions for the vulnerabilities it identifies.

Does it work with any programming language?

Yes, it uses pattern matching and semantic analysis via specialized subagents that are applicable across most modern web and backend frameworks.

Expert Mode launches additional red team agents to simulate how multiple findings could be chained together into an exploit, providing DREAD scores for risk assessment.

How does the parallel execution work?

It dispatches 10 independent subagents simultaneously, each with its own context window, to analyze specific vulnerability classes like injection or broken access control.

OWASP Security Auditor

Name: OWASP Security Auditor
Author: florianbuetow

byflorianbuetow

•

Security & Testing

Performs comprehensive security audits based on the OWASP Top 10 vulnerabilities using parallel subagent analysis.

The OWASP Security Auditor skill enables Claude to conduct deep, multi-category security reviews of your codebase. By dispatching ten specialized subagents in parallel—each focused on a specific OWASP Top 10 category such as Broken Access Control, Injection, or SSRF—it ensures thorough coverage while managing context window efficiency. The skill automatically filters irrelevant categories based on your technology stack, consolidates findings into a unified report, and offers an 'Expert Mode' for simulated red teaming, exploit chain analysis, and DREAD risk scoring.

Key Features

01Expert Mode for red team simulation and DREAD scoring of vulnerabilities

026 GitHub stars

03Parallel analysis of all 10 OWASP Top 10 (2021) vulnerability categories

04Automated findings consolidation, deduplication, and severity ranking

05Support for inline fix suggestions and educational security explanations

06Smart pre-flight checks to skip irrelevant categories and optimize performance

Use Cases

01Integrating automated security linting into a developer's local workflow

02Auditing a new codebase for common web vulnerabilities before a production release

03Simulating multi-step attack chains to understand the exploitability of found issues

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code owasp

For use in Claude.ai and ChatGPT

Download Skill