moai-ref-owasp-checklist

OWASP Top 10 security checklist, authentication patterns, input validation, and HTTP security headers reference. Agent-extending skill that amplifies backend-implementation and security-audit workflows with production-grade security patterns. NOT for: frontend UI, DevOps deployment, performance optimization, testing strategy.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, highly actionable reference checklist with explicit verification checkpoints and a clean single-file structure; the only weakness is some verbose explanatory prose in the trust-boundary and rationalizations sections that could be tightened.

Suggestions

Tighten the "Trust Boundary Verification Principles" table cells into concise principle/defense phrases rather than full-sentence paragraphs.

Trim the "Common Rationalizations" explanations to the rebuttal only, dropping restatements of well-known facts like "OWASP applies to all web applications".

Dimension	Reasoning	Score
Conciseness	Mostly efficient dense reference tables, but the "Trust Boundary Verification Principles" table and "Common Rationalizations" section contain long explanatory prose (e.g. "OWASP applies to all web applications") that restates concepts Claude already knows and could be tightened.	2 / 3
Actionability	Highly concrete, copy-paste-ready guidance: bcrypt cost 12+, JWT access expiry 15-30 minutes, RS256, httpOnly+secure+sameSite, and exact header values like `max-age=31536000; includeSubDomains`.	3 / 3
Workflow Clarity	As a reference skill it is unambiguous, and the "Verification" section provides explicit validation checkpoints (e.g. "show grep results for common secret patterns", "show which items were evaluated").	3 / 3
Progressive Disclosure	Self-contained with no bundle files and well-organized into clearly headed sections and tables; no nested/deep references, appropriate for a single-file reference checklist.	3 / 3
	Total	11 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description with strong trigger terms and explicit exclusions; its main weakness is the absence of an explicit "Use when..." trigger clause, leaving the invocation condition only implied.

Suggestions

Add an explicit trigger clause such as "Use when implementing backend APIs or conducting security audits referencing OWASP Top 10, authentication, input validation, or HTTP security headers" to lift completeness to 3.

Lead with the user-facing trigger (the "when") before the agent-extending framing so the invocation condition is unambiguous.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete capabilities: "OWASP Top 10 security checklist, authentication patterns, input validation, and HTTP security headers reference" — several distinct, concrete content domains rather than vague language.	3 / 3
Completeness	Clearly states what it provides, but the "when" is only implied via "amplifies backend-implementation and security-audit workflows" with no explicit "Use when..." trigger clause; per the judging guideline a missing trigger clause caps completeness at 2.	2 / 3
Trigger Term Quality	Natural terms a security-focused user would say are well covered: "OWASP Top 10", "injection, XSS, CSRF", "authentication", "input validation", "HTTP security headers".	3 / 3
Distinctiveness Conflict Risk	Clear security niche with explicit exclusions ("NOT for: frontend UI, DevOps deployment, performance optimization, testing strategy") making it unlikely to trigger for the wrong skill.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: modu-ai/moai-adk
Path: .claude/skills/moai-ref-owasp-checklist/SKILL.md
Commit: 05117b6

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.