Owasp Security

This walks through the OWASP Top 10 with side-by-side code comparisons showing vulnerable patterns and their fixes. You get examples for everything from broken access control and IDOR prevention to SQL injection, cryptographic failures, and rate limiting. The parameterized query examples alone are worth having on hand when you're doing security reviews or onboarding someone who hasn't seen an injection attack. It covers TypeScript/Node.js with real libraries like bcrypt, helmet, and zod, so you can actually copy patterns into your codebase. Honestly most useful as a reference when you know something is wrong but need to remember the correct way to handle session cookies or encrypt sensitive data.

skills.sh installs: 3.1K
GitHub stars: 296
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add hoodini/ai-agents-skills --skill owasp-security --agent claude-code

Installs into .claude/skills of the current project.

Files

OWASP Top 10 Security

Prevent common security vulnerabilities in web applications.

OWASP Top 10 (2021)

#	Vulnerability	Prevention
A01	Broken Access Control	Proper authorization checks
A02	Cryptographic Failures	Strong encryption, secure storage
A03	Injection	Input validation, parameterized queries
A04	Insecure Design	Threat modeling, secure patterns
A05	Security Misconfiguration	Hardened configs, no defaults
A06	Vulnerable Components	Dependency scanning, updates
A07	Auth Failures	MFA, secure session management
A08	Data Integrity Failures	Input validation, signed updates
A09	Logging Failures	Comprehensive audit logs
A10	SSRF	URL validation, allowlists

A01: Broken Access Control

Prevention Patterns

// ❌ BAD: No authorization check
app.get('/api/users/:id', async (req, res) => {
  const user = await db.users.findById(req.params.id);
  res.json(user);
});

SKILL.md on GitHub