1. Habit
  2. Skills
  3. OWASP Security Check skill
sergiodxa · 2K installs

OWASP Security Check skill
Runs by itself, pull request opened.

Security flaws caught before deploy.

Install the OWASP Security Check skill and make it a habit: follow https://gethabit.dev/skills/sergiodxa/owasp-security-check.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

2K installs92 starsMIT licenceSource on GitHub ↗

OWASP Security Check

by sergiodxa · 2K installs

The skill

Owasp security check is a skill for web developers that audits web apps and REST APIs against 20 rules based on the OWASP Top 10, from access control and injection to headers, CORS and rate limiting.

Only when you ask.

The habit

Security flaws caught before deploy.

↻ Runs by itselfpull request opened

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

pull request opened. Runs in GitHub Actions or Claude Code routine.

  • ↻ pull request opened
  • pull_request.opened

02

It checks its work

findings in full format. If a check fails, it tells you.

  • ✓every finding has severity, category, file, issue, impact and fix
  • ✓npm audit reports no critical vulnerability
  • ✓no hardcoded secret pattern in changed files

03

It remembers

security findings log. The next run reads it first: open critical and high findings.

loops/owasp-pr-audit-loop/run-log.md

One run, step by step.
Then it stops.

Stop ruleStops after one pull request per run, with one retry.

  1. 01

    Identify the app

    Decide if the change is a web app, REST API, SPA, SSR or mixed.

  2. 02

    Check critical rules

    Review access control, auth, data protection and input and output security first.

  3. 03

    Check high rules

    Review configuration, security headers, CORS, CSRF and sessions.

  4. 04

    Check medium rules

    Review API security, rate limiting, logging and dependencies with npm audit.

  5. 05

    Report

    Write each finding with severity, file, impact and a remediation code example.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the OWASP Security Check skill helps.

Use it when

  • ✓ You review code for vulnerabilities
  • ✓ You audit an API before release
  • ✓ You check auth and sessions

Skip it when

  • – You need a penetration test
  • – The code is not a web app

Questions

OWASP Security Check skill, answered.

Where are rule details?

Each rule has its own file in the rules folder, such as broken-access-control.md.

What gets fixed first?

Critical issues like injection, missing auth and hardcoded secrets.

How do I install the OWASP Security Check skill?

Copy the prompt at the top into your agent. It installs the skill from sergiodxa/agent-skills and sets up the habit. Or run npx skills add sergiodxa/agent-skills --skill owasp-security-check.

Is the OWASP Security Check skill free?

Yes. It is published under MIT. Habit is free too.

OWASP Security Check. Now as a habit.

Install the OWASP Security Check skill and make it a habit: follow https://gethabit.dev/skills/sergiodxa/owasp-security-check.md

  • Free
  • No account
  • Undo in one line

All sergiodxa skills →More code skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by sergiodxa, published under MIT. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.