dancon-owasp10-review
Parallel OWASP Top 10:2025 security review of a web application codebase using 10 specialist agents. Trigger whenever the user asks for a security review, security audit, OWASP review, vulnerability assessment, code security scan, or threat analysis of a web app codebase. Also trigger on mentions of "OWASP Top 10", "security vulnerabilities", "code audit", "AppSec", or requests to check code for injection, XSS, access control, auth, or crypto issues. Trigger for casual requests like "is my code secure?", "check for vulnerabilities", or "any security issues?". Launches 10 parallel agents (one per OWASP category) producing a report with context-sensitive remediations. Secrets found are flagged but always shown as REDACTED.
88
85%
Does it follow best practices?
Impact
92%
1.87xAverage score across 3 eval scenarios
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that thoroughly covers what the skill does (parallel OWASP Top 10 security review with 10 specialist agents producing remediation reports) and when to trigger it (with extensive natural language trigger terms spanning formal security terminology and casual user requests). The description is specific, comprehensive, and occupies a clear niche that would be easily distinguishable from other skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: parallel OWASP Top 10:2025 security review, launches 10 parallel agents (one per OWASP category), produces a report with context-sensitive remediations, flags secrets as REDACTED. Very concrete about what it does and how. | 3 / 3 |
Completeness | Clearly answers both 'what' (parallel OWASP Top 10:2025 security review using 10 specialist agents, producing reports with remediations, redacting secrets) and 'when' (explicit 'Trigger whenever...' clause with extensive trigger conditions covering formal and casual requests). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural trigger terms including formal ('security audit', 'OWASP review', 'vulnerability assessment', 'AppSec', 'threat analysis') and casual ('is my code secure?', 'check for vulnerabilities', 'any security issues?'), plus specific vulnerability types (injection, XSS, access control, auth, crypto issues). | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche: OWASP Top 10:2025 security review of web application codebases with 10 parallel agents. The specificity to security auditing, OWASP categories, and web app codebases makes it very unlikely to conflict with other skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
70%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured orchestration skill with excellent workflow clarity and good progressive disclosure. Its main weaknesses are moderate verbosity (explaining OWASP categories Claude already knows, repeating the secrets rule multiple times) and limited concrete actionability within the skill itself — the real review instructions are delegated to reference files. The finding format template and severity classification are strong actionable elements.
Suggestions
Trim the OWASP category table to just IDs and names since Claude already knows the Top 10 focus areas, or consolidate it with the file-heuristics table to avoid redundancy.
Add a concrete example of how to invoke a subagent (e.g., exact Cowork/Task syntax) rather than just describing what each agent receives, to improve actionability.
Reduce repetition of the secrets-handling rule — state it once definitively rather than restating it in the guiding principles section.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is reasonably well-structured but includes some unnecessary verbosity. The introductory paragraph restates what the YAML description already covers, the secrets handling section is somewhat repetitive (the rule is stated, then examples given, then restated), and the OWASP category table includes 'Key Focus Areas' that Claude already knows. The heuristics table in Step 1 is useful but could be more compact. However, most content earns its place. | 2 / 3 |
Actionability | The workflow steps are clearly described and the finding format template is concrete and copy-paste ready. However, the actual review logic is delegated to `references/agent_prompts.md` and `references/report_template.md`, which we cannot evaluate. The skill itself contains no executable code — no actual commands for extraction, no real code examples for spawning agents, and the 'view tool' usage is mentioned but never demonstrated with concrete syntax. The finding format template is the strongest actionable element. | 2 / 3 |
Workflow Clarity | The 4-step workflow is clearly sequenced with explicit phases: discover → review → assemble → report. Each step has numbered sub-steps. The skill handles branching (subagent vs sequential mode), includes validation through evidence-based findings requirements, and the severity-to-status derivation provides a clear decision framework. The workflow is comprehensive and well-ordered. | 3 / 3 |
Progressive Disclosure | The skill provides a clear overview with well-signaled one-level-deep references to `references/agent_prompts.md` and `references/report_template.md`. The main SKILL.md contains the workflow, principles, and format without inlining the full agent prompts or report template. Navigation is clear and references are mentioned at point of use and summarized at the end. | 3 / 3 |
Total | 10 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- danielyan-consulting/skills
- Commit
99b52ce
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.