owasp-security

Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security. Covers OWASP Top 10:2025, ASVS 5.0, and Agentic AI security (2026).

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./owasp-security/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A comprehensive, actionable security reference with strong UNSAFE→SAFE code examples and good structure, but it is a long monolithic document that inlines material (notably the 20-language quirks) that would be better placed in one-level-deep reference files, and it lacks an explicit review workflow with validation checkpoints.

Suggestions

Move the 'Language-Specific Security Quirks' section (and optionally the ASVS levels / agentic AI risk tables) into reference files (e.g., references/language-quirks.md, references/agentic-ai.md) and replace the inline bulk with one-level-deep pointers like 'See [language-quirks.md](references/language-quirks.md) for the language you are working in'.

Add a short explicit review workflow at the top — e.g., 1) Identify the language/framework context, 2) Run the applicable checklist, 3) For each finding, propose a SAFE fix and verify it addresses the vulnerability — to add validation checkpoints and lift workflow clarity.

Trim redundant framing lines (e.g., the 'Deep Security Analysis Mindset' prose overlaps the language-quirks section) to tighten the token budget.

Dimension	Reasoning	Score
Conciseness	The body is dense and format-efficient (tables, terse UNSAFE/SAFE pairs, checklists) and avoids explaining basic concepts, but at ~530 lines the inlined 20-language-quirks reference and broad ASVS/agentic tables exceed a lean token budget and could be tightened or externalized; not a 4 because several sections pad the overview beyond what the trigger needs.	3 / 5
Actionability	Provides many concrete, executable UNSAFE→SAFE code pairs across SQL injection, command injection, password storage, access control, error handling, and per-language pitfalls, plus specific checklist items and named mitigations; not a 5 because some guidance remains checklists rather than fully copy-paste-ready commands, though that is appropriate for a review skill.	4 / 5
Workflow Clarity	As a reference/checklist skill it provides ordered checklists and a 'When to Apply This Skill' section, but there is no explicit multi-step review workflow with validation checkpoints (e.g., run review → triage findings → confirm fix); the absence of a validate→fix→retry feedback loop caps it at 3 even though it is not a destructive-batch skill.	3 / 5
Progressive Disclosure	The body is well-organized with clear section headers and tables, but no bundle files (references/scripts/assets) exist and roughly 250 lines of language-specific quirks plus the bulk ASVS/agentic tables are inlined in SKILL.md rather than split into one-level-deep reference files with clear navigation; not a 4 because content that clearly belongs in separate files is inline and no references are signaled.	3 / 5
	Total	13 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-targeted description with an explicit 'Use when' trigger clause and concrete security scenarios anchored to recognized standards. The main limitation is that the 'what' leans on standard names rather than a fully enumerated action list, and a few natural synonyms are missing.

Suggestions

Lead with a short action-verb inventory of what the skill does (e.g., 'Audits code against OWASP Top 10:2025, ASVS 5.0, and agentic AI risks') before the 'Use when' triggers to sharpen the 'what'.

Add a couple of high-frequency natural synonyms (e.g., 'penetration testing', 'vulnerability review', 'hardening') to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Quotes several concrete triggers — 'reviewing code for security vulnerabilities', 'implementing authentication/authorization', 'handling user input' — and names specific standards (OWASP Top 10:2025, ASVS 5.0, Agentic AI 2026), giving multiple specific actions with only minor coverage gaps; not a 5 because triggers are framed as scenarios rather than a comprehensive enumerated action list.	4 / 5
Completeness	Explicitly answers 'when' via the 'Use when reviewing...implementing...handling...or discussing' clause and the 'what' via 'Covers OWASP Top 10:2025, ASVS 5.0, and Agentic AI security (2026)'; not a 5 because the 'what' is coverage-of-standards rather than a concrete action inventory.	4 / 5
Trigger Term Quality	Includes natural phrases users would say ('reviewing code for security vulnerabilities', 'handling user input', 'web application security') with good keyword coverage; not a 5 because a few common synonyms (e.g., 'pen testing', 'vulnerability scan', 'auth') are absent.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (security review anchored to OWASP/ASVS/agentic AI) with distinct, specific triggers and minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (537 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: figlabhq/agent-skills
Path: owasp-security/SKILL.md
Commit: abac51b

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.