Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →modu-ai/moai-ref-owasp-checklist
OWASP Top 10 security checklist, authentication patterns, input validation, and HTTP security headers reference. Agent-extending skill that amplifies backend-implementation and security-audit workflows with production-grade security patterns. NOT for: frontend UI, DevOps deployment, performance optimization, testing strategy.
Passed 18 of 23 test cases with the skill, and 12 of 23 without it.
and 8 more in the full report
7 fixed11 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are preparing to deploy our user management REST API to production. Please run a security audit across the codebase against OWASP API standards, checking sensitive data handling, session settings, and endpoint security. Provide a summary listing each evaluated item, highlighted red flags, severity ratings, and the exact code changes needed to remediate any security defects.
| Checked | Without skill | With skill |
|---|---|---|
| Classifies findings using P0, P1, P2, and P3 severity designations. | Missed | Passed |
| Uses the A1 through A10 taxonomy format rather than 2023 numbered tags for API security findings. | Missed | Passed |
| Specifies access token expiry between 15 and 30 minutes. | Missed | Passed |
The instructions your model reads when the skill loads.
manager-develop - Applies checklist during backend API implementation (cycle_type=tdd or cycle_type=ddd context)/moai review with a security focus - Primary security-audit invocation surface; equivalently available as a per-spawn Agent(general-purpose) security specialist per archived-agent-rejection.md §C| Rank | Vulnerability | Check | Defense |
|---|---|---|---|
| A1 | BOLA (Broken Object Level Authorization) | Can user A access user B's resources? | Verify object ownership at every endpoint |
| A2 | Broken Authentication | Weak passwords, unlimited login attempts? | bcrypt (cost 12+), rate limit, MFA |
| A3 | Broken Object Property Level Authorization | Are hidden fields exposed in responses? | Response DTOs, field-level filtering |
| A4 | Unrestricted Resource Consumption | Can mass requests crash the server? | Rate limiting, enforce pagination limits |
| A5 | Broken Function Level Authorization | Can regular users call admin APIs? | RBAC middleware, permission checks |
| A6 | Unrestricted Access to Sensitive Business Flows | Can a sensitive flow be automated or abused in bulk? | Flow-level rate limits, anomaly detection, challenge on abuse signals |
| A7 | SSRF (Server-Side Request Forgery) | Can URL input reach internal or metadata endpoints? | Egress allowlist, block internal/metadata ranges, validate fetch targets |
| A8 | Security Misconfiguration | Debug mode, verbose errors, or default accounts exposed? | Production-hardened config, security headers, inspect deployed config |
| A9 | Improper Inventory Management | Undocumented, shadow, or old-version endpoints reachable? | Maintain an API inventory; deprecate and decommission old versions |
| A10 | Unsafe API Consumption | Are external API responses trusted blindly? | Validate external responses, set timeouts |
| Setting | Recommended Value |
|---|---|
| Access Token Expiry | 15-30 minutes |
| Refresh Token Expiry | 7-14 days |
| Algorithm | RS256 (asymmetric) or HS256 |
| Storage | httpOnly + secure + sameSite cookie |
| Payload | Minimal: userId, role only (no PII) |
| Renewal | Silent refresh or token rotation |
test cases passed, vs 12 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.