Testing owasp top10 using Claude Skills
SaferSkills independently audited test-owasp-top10-web-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A hands-on demo environment for testing Python web applications against OWASP Top 10:2025 vulnerabilities using Claude Code Agent Skills.
Setup: Copy the skills from https://github.com/scholarly360/owasp-top10-web-skills into your .claude/skills/ directory first before running any security assessments.This project pairs a deliberately vulnerable FastAPI application (main.py) with structured Claude Code skills that guide AI agents through systematic OWASP security assessments. Instead of ad-hoc security prompts, each skill encodes a repeatable, documented testing procedure mapped to CWE identifiers and real attack scenarios.
main.py is an intentionally insecure FastAPI application containing the following flaws for testing purposes:
| Vulnerability | Endpoint | OWASP Category |
|---|---|---|
| SQL Injection | POST /login | A05 — Injection |
| Command Injection | GET /ping | A05 — Injection |
| Broken Authentication | Token = plaintext username | A07 — Auth Failures |
| Path Traversal | GET /file | A01 — Broken Access Control |
| Sensitive Data Exposure | GET /users returns passwords | A02 — Cryptographic Failures |
| IDOR / Mass Assignment | PUT /user/{id} allows privilege escalation | A01 — Broken Access Control |
Skills live in .claude/skills/ and are loaded automatically by Claude Code:
| Skill | OWASP Category |
|---|---|
broken-access-control | A01:2025 — Broken Access Control |
security-misconfiguration | A02:2025 — Security Misconfiguration |
injection | A05:2025 — Injection |
cryptographic-failures | A04:2025 — Cryptographic Failures |
authentication-failures | A07:2025 — Authentication Failures |
software-supply-chain-failures | A03:2025 — Software Supply Chain |
software-data-integrity-failures | A08:2025 — Software & Data Integrity Failures |
security-logging-alerting-failures | A09:2025 — Security Logging & Alerting Failures |
insecure-design | A06:2025 — Insecure Design |
mishandling-exceptional-conditions | A10:2025 — Mishandling of Exceptional Conditions |
Invoke a skill in Claude Code using a natural language prompt referencing the skill name:
Test 'main.py' using 'broken-access-control' skills
Test 'main.py' using 'injection' skillsEach skill produces a structured report with findings mapped to CWE IDs, severity ratings, and remediation guidance.
Skills framework: https://github.com/scholarly360/owasp-top10-web-skills
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.