agamm/claude-code-owasp

Claude Code skill for OWASP security best practices (2025-2026). Includes Top 10:2025, ASVS 5.0, Agentic AI security, and 20+ language-specific security quirks.

What it solves

This project provides a specialized security knowledge base for Claude Code, enabling the AI to perform high-accuracy security reviews and implement secure coding patterns based on the latest OWASP standards. It prevents the AI from relying on outdated security information (such as old ASVS IDs or renamed Top 10 categories) by providing verified, up-to-date references.

How it works

It is implemented as a "skill" directory containing Markdown files that Claude Code loads. The core SKILL.md file provides immediate access to the OWASP Top 10:2025, triage rubrics, and security checklists. Additional detailed references, including language-specific security quirks for over 20 languages and deep-dives into attack vectors, are stored in a reference/ folder and loaded on demand to optimize performance.

Who it’s for

Developers using Claude Code who need to ensure their applications—including traditional web apps, RAG systems, and AI agentic systems—adhere to modern security best practices.

Highlights

  • Up-to-date Standards: Includes OWASP Top 10:2025, ASVS 5.0, and the 2025 LLM Top 10.
  • Agentic AI Security: Specifically covers the 2026 OWASP Agentic AI Security risks (ASI01-ASI10).
  • Broad Language Support: Provides security patterns and unsafe/safe examples for 20+ programming languages.
  • Triage Rubric: Includes a rubric to help the AI confirm attacker-controlled input and sink reachability to reduce false positives during security reviews.

Related

  • Project
    Masriyan/Claude-Code-CyberSecurity-Skill

    A collection of 19 specialized skill modules for Claude Code that provide structured methodologies and automation for cybersecurity professionals across offensive and defensive operations.

  • Project
    affaan-m/agentshield

    A security auditor for AI agent configurations that scans Claude Code setups for secrets, permission misconfigurations, and prompt injection vectors.

  • Project
    jamditis/claude-skills-journalism

    A genuine open‑source repo that bundles reusable “Agent Skills” for Claude Code (and Codex) to help journalists and newsroom teams automate tasks such as fact‑checking, source verification, FOIA filing, data‑journalism, PDF design, and multi‑agent workflows. Install via Claude’s plugin commands or copy individual `SKILL.md` folders; the repo includes a catalog, docs site, and up‑to‑date skill set.

  • Project
    bruc3van/agent-skills-guard

    A visual management and security auditing tool for Claude Code skills, providing a curated marketplace and a multi-layer scanning engine to prevent malicious code execution.

  • Project
    mxyhi/ok-skills

    A curated collection of reusable skills and playbooks for AI coding agents, providing portable instructions for tasks like browser automation, documentation lookup, and codebase planning.