moai-ref-owasp-checklist

OWASP Top 10 security checklist, authentication patterns, input validation, and HTTP security headers reference. Agent-extending skill that amplifies backend-implementation and security-audit workflows with production-grade security patterns. NOT for: frontend UI, DevOps deployment, performance optimization, testing strategy.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/moai-ref-owasp-checklist/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, actionable security reference with concrete values and tool names, held back by the lack of an explicit sequenced review workflow and a monolithic single-file structure despite a declared progressive-disclosure intent.

Suggestions

Add an explicit numbered 'Security review workflow' (e.g. 1. map endpoints to OWASP items, 2. run the Verification grep checks, 3. assign severity per the P0-P3 table, 4. block/fix per severity) to raise workflow clarity.

Split the larger tables (e.g. full OWASP API Top 10 detail, HTTP header catalogue) into references/ files and link to them from SKILL.md to realize the declared progressive_disclosure structure.

Dimension	Reasoning	Score
Conciseness	Dense, token-efficient tables with no padding or explanation of concepts Claude already knows (e.g. no 'OWASP stands for...'); the 'Common Rationalizations' table is slightly explanatory, keeping it just below a 5.	4 / 5
Actionability	Provides concrete, copy-paste-ready values (bcrypt cost 12+, JWT RS256, 'max-age=31536000; includeSubDomains', 'Never origin: * with credentials') and named tools (Zod, Joi, pydantic, Prisma, GORM); not a 5 because it offers patterns/values rather than full executable code blocks.	4 / 5
Workflow Clarity	The 'Verification' checklist supplies validation checkpoints and 'Security Review Severity Levels' sequences response actions, but there is no explicit numbered multi-step review workflow tying them together.	3 / 5
Progressive Disclosure	Section headers are well-organized, but the file is a monolithic ~130-line inline reference with no external bundle files; the frontmatter declares progressive_disclosure enabled (level1/level2 tokens) yet it is not realized in any file structure.	3 / 5
	Total	14 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-bounded security reference description with strong distinctiveness, weakened only by the absence of an explicit 'Use when...' trigger clause that forces completeness to cap at 3.

Suggestions

Add an explicit positive trigger clause such as 'Use when implementing or auditing backend APIs for OWASP Top 10, authentication, input validation, or HTTP security header coverage.'

Include a few natural synonyms users say (e.g. 'appsec', 'web security review') to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Lists several concrete reference domains ('OWASP Top 10 security checklist, authentication patterns, input validation, and HTTP security headers reference'); not a 5 because it does not enumerate the individual sub-capabilities within each domain.	4 / 5
Completeness	The 'what' is clear, but there is no explicit positive 'Use when...' trigger clause — 'when' is only weakly implied by 'amplifies backend-implementation and security-audit workflows', so completeness is capped at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Includes natural terms a user would say ('OWASP Top 10', 'security checklist', 'authentication', 'security-audit'); missing some synonyms and file/extension-style variants that would push it to 5.	4 / 5
Distinctiveness Conflict Risk	A clear OWASP/security-reference niche combined with an explicit negative boundary ('NOT for: frontend UI, DevOps deployment, performance optimization, testing strategy') yields minimal conflict risk.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: modu-ai/moai-adk
Path: .claude/skills/moai-ref-owasp-checklist/SKILL.md
Commit: 4100d87

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.