agamm/claude-code-owasp

Claude Code skill for OWASP security best practices (2025-2026). Includes Top 10:2025, ASVS 5.0, Agentic AI security, and 20+ language-specific security quirks.

What it solves

This project provides a specialized security skill for Claude Code, enabling the AI to perform high-accuracy security reviews of codebases. It solves the problem of outdated or inaccurate security guidance by providing the model with verified, up-to-date OWASP standards (2025-2026) for web applications, LLM applications, and AI agent systems.

How it works

It functions as a plugin or skill for Claude Code, consisting of a SKILL.md file for core logic and a reference/ directory for deep-dive documentation. When triggered by security-related prompts, Claude Code loads these guidelines to apply a structured security review workflow, a finding-triage rubric to reduce false positives, and a standardized reporting format. It includes language-specific security quirks for over 20 languages and coverage for standards like OWASP Top 10:2025 and ASVS 5.0.

Who it’s for

Developers building secure applications who use Claude Code and want to integrate professional security auditing standards directly into their AI-assisted development workflow.

Highlights

  • Comprehensive Standards: Covers OWASP Top 10:2025, ASVS 5.0, and the 2026 standards for LLM and Agentic AI security.
  • Reduced False Positives: Uses a triage rubric to confirm attacker-controlled input and sink reachability before reporting.
  • Broad Language Support: Provides security patterns for 20+ languages across web, systems, and mobile platforms.
  • Integrated Evals: Includes a test suite to measure the improvement in security finding accuracy between the model's base performance and the the skill-enhanced performance.

Related

  • Project
    Masriyan/Claude-Code-CyberSecurity-Skill

    A collection of 22 specialized skill modules for Claude Code that provide structured methodologies and automation scripts for professional cybersecurity operations.

  • Project
    mxyhi/ok-skills

    OK Skills is a library of 31 ready‑to‑use *skill packs* for AI coding agents (Codex, Claude Code, Cursor, etc.). Each skill lives in its own directory with a `SKILL.md` that tells the agent how to run the underlying script (e.g., browser automation, docs lookup, planning, design). Install by cloning into `~/.agents/skills` (or the Autohand equivalent), copy the `CLAUDE_AGENTS.md` sections into your agent’s config, and then ask the agent to “Use <skill‑name> …”. The repo provides categories such as Research, Planning, Automation, Frontend, and Utilities, and serves developers who want portable, repeatable AI‑agent capabilities instead of ad‑hoc prompts.

  • Project
    hypnguyen1209/offensive-claude

    A spec-driven offensive security framework for Claude Code that implements a structured 9-phase Cyber Kill Chain workflow with safety guards and 32 specialized security skills.

  • Project
    bruc3van/agent-skills-guard

    A visual management and security tool for Claude Code skills that provides an app-store-like experience with automated risk scanning to prevent malicious code execution.

  • Dispatch
    Claude Code Best Practices Guide

    Anthropic provides a comprehensive set of best practices for optimizing Claude Code, an agentic coding environment, focusing on context window management and autonomous verification.