<Devsly/>
NotebookLM Watermark Remover
Remove the NotebookLM watermark from PDF slide exports — free, unlimited, and 100% in your browser.
View
NotebookLM Video Watermark Remover
Remove the NotebookLM watermark from every frame of your MP4 and auto-trim the end card — free and unlimited.
View
Gemini Watermark Remover
Remove the Gemini (Veo) sparkle watermark from every frame of your AI-generated MP4 — free and unlimited.
View
MCP https://devsly.io/mcp MCP Tools Best Skills API Docs
Devsly

Keyboard Shortcuts

Navigation

Quick Search
⌘ / Ctrl + K
Toggle Dark Mode
⌘ / Ctrl + D
Close Dialogs
Esc

Tool Actions

Execute / Process
⌘ / Ctrl + Enter
Clear Input
⌘ / Ctrl + Shift + C
Copy Output
⌘ / Ctrl + Shift + X

Editor

Select All
⌘ / Ctrl + A
Undo
⌘ / Ctrl + Z
Redo
⌘ / Ctrl + Shift + Z

Updated 6mo ago

by scholarly360

owasp-top10-web-skills

Agent Skills for OWASP Top 10 Application Security Risks (https://owasp.org/Top10/2025/)

Works with
  • Claude
View on GitHub (opens in a new tab)

22 GitHub stars (22)

Steady at 22 stars — no new stars in the 16 days since Sep 30.

  • 10 skills (10 skills found in its SKILL.md files)
  • 3 forks (3 forks)
  • 6mo ago last update (Last updated 6mo ago)

Install

Skills CLI

npx skills add scholarly360/owasp-top10-web-skills

Asks which skills and agents to install. Just one: npx skills add scholarly360/owasp-top10-web-skills --skill authentication-failures — add -g for every project.

Claude Code

git clone https://github.com/scholarly360/owasp-top10-web-skillscp -r "owasp-top10-web-skills/skills/authentication-failures" ~/.claude/skills/

Copies the authentication-failures skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.

Plugin

/plugin marketplace add scholarly360/owasp-top10-web-skills

Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.

Skills can run code on your machine — read the SKILL.md first.

What it does

In the author's own words, from each skill's SKILL.md.

  • authentication-failures

    Use this skill whenever you need to audit, test, or fix Authentication Failures (OWASP A07:2025) in Python web applications — especially FastAPI and Flask. Triggers include: any mention of JWT security, session management, brute force protection, credential stuffing, password policy, MFA enforcement, login rate limiting, session fixation, token validation, or auth-related error messages. Also tri…

    skills/authentication-failures/SKILL.md on GitHub (opens in a new tab)

  • broken-access-control

    Security testing skill for A01:2025 Broken Access Control — the #1 OWASP risk for two consecutive cycles. Use this skill whenever the user asks about: access control vulnerabilities, IDOR (insecure direct object references), authorization bugs, SSRF testing, CORS misconfiguration, privilege escalation, JWT/session manipulation, CSRF protection, or auditing FastAPI/Flask endpoints for missing auth…

    skills/broken-access-control/SKILL.md on GitHub (opens in a new tab)

  • cryptographic-failures

    Detect, audit, and remediate A04:2025 Cryptographic Failures in Python web applications (FastAPI and Flask). Use this skill whenever the user asks about crypto security, password hashing, JWT configuration, TLS/SSL verification, weak randomness, hardcoded secrets, or any code using hashlib, random, ssl, jwt, passlib, or cryptography modules. Also trigger when the user wants to audit security, sca…

    skills/cryptographic-failures/SKILL.md on GitHub (opens in a new tab)

  • injection

    Expert Python security testing skill for OWASP A05:2025 — Injection vulnerabilities in FastAPI and Flask applications. Use this skill whenever the user asks about: SQL injection, XSS, SSTI (Server-Side Template Injection), OS command injection, ORM injection, LLM prompt injection, input validation, parameterized queries, Jinja2 escaping, or any untrusted data reaching an interpreter (database, OS…

    skills/injection/SKILL.md on GitHub (opens in a new tab)

  • insecure-design

    Detect, analyze, and remediate OWASP A06:2025 Insecure Design vulnerabilities in Python web applications (FastAPI and Flask). Use this skill whenever the user asks about architecture-level security flaws, threat modeling, rate limiting gaps, business logic vulnerabilities, insecure file uploads, race conditions, tenant isolation failures, or client-side enforcement of server-side security. Trigge…

    skills/insecure-design/SKILL.md on GitHub (opens in a new tab)

  • mishandling-exceptional-conditions

    Detect, analyze, and remediate OWASP A10:2025 — Mishandling of Exceptional Conditions in Python web applications (FastAPI and Flask). Use this skill whenever the user asks about error handling security, exception management, fail-open vulnerabilities, stack trace exposure, uncaught exceptions, transaction rollback safety, or resource leaks in exception paths. Also trigger for any OWASP A10 audit,…

    skills/mishandling-exceptional-conditions/SKILL.md on GitHub (opens in a new tab)

  • security-logging-alerting-failures

    Use this skill whenever auditing, reviewing, or testing Python web applications (FastAPI or Flask) for OWASP A09:2025 — Security Logging & Alerting Failures. Trigger this skill when the user mentions: logging security, audit trails, log injection, sensitive data in logs, alerting gaps, insufficient logging, SIEM integration, log monitoring, incident detection readiness, or any request to audit or…

    skills/security-logging-alerting-failures/SKILL.md on GitHub (opens in a new tab)

  • security-misconfiguration

    Detect, audit, and remediate Security Misconfiguration vulnerabilities (OWASP A02:2025) in Python web applications — especially FastAPI and Flask. Use this skill whenever a user asks about: hardening a Python/FastAPI/Flask app, checking for debug mode leaks, missing security headers, exposed API docs, hardcoded secrets, insecure cookie flags, XXE vulnerabilities, or any OWASP A02 misconfiguration…

    skills/security-misconfiguration/SKILL.md on GitHub (opens in a new tab)

  • software-data-integrity-failures

    Security testing skill for OWASP A08:2025 — Software or Data Integrity Failures in Python web applications (FastAPI and Flask). Use this skill whenever the user wants to audit, detect, test, or fix integrity vulnerabilities including: insecure deserialization (pickle, yaml, jsonpickle, dill), mass assignment flaws, untrusted CDN/module inclusion, unsigned updates, CI/CD pipeline integrity, or Sub…

    skills/software-data-integrity-failures/SKILL.md on GitHub (opens in a new tab)

  • software-supply-chain-failures

    Expert guidance on detecting, assessing, and remediating Software Supply Chain Failures (OWASP A03:2025) in Python applications — the highest-exploit-score category in the 2025 OWASP Top 10. Use this skill whenever the user mentions dependency scanning, vulnerable packages, SBOMs, pip-audit, safety check, lockfile integrity, hash pinning, transitive dependencies, CI/CD pipeline security, compromi…

    skills/software-supply-chain-failures/SKILL.md on GitHub (opens in a new tab)

Review before you install

A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.