Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

OWASP Review — measured AI agent skill | DecimalAI

archive228/owasp-review

SkillScore96Maintained

Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.

Securityby archive228

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/archive228-owasp-review/SKILL.md

decimalai skills pull archive228-owasp-review --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/archive228-owasp-review/SKILL.md https://app.decimal.ai/s/archive228-owasp-review/SKILL.md

Raw file: /s/archive228-owasp-review/SKILL.md ↗ · machine-readable summary at /s/archive228-owasp-review.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 6h ago

Yes — +26% lift-3% tokens0% turns96% of whole cases pass with skill (22/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	8%	0%
case-06	✗→✓	▲ Improved	17%	0%
case-09	✗→✓	▲ Improved	-12%	0%
case-10	✗→✓	▲ Improved	3%	0%
case-16	✗→✓	▲ Improved	-15%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

archive228 / loopkit

skills/owasp-review/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

OWASP Review

Check the diff for each, with the exact line:

Injection — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
Broken access control — does it verify the user OWNS the resource, not just that they're logged in?
Auth — secrets in code? tokens without expiry? password compare not constant-time?
SSRF — user-controlled URL fetched server-side without an allowlist.
Sensitive data — PII/secrets logged, returned in errors, or sent unencrypted.
Deserialization — untrusted input into pickle/yaml.load/eval.
Dependency — a new package with known CVEs or no maintenance.

Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".

Want to see if archive228/owasp-review would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.