{"name":"@crewd/owasp-top10","version":"1.0.0","type":"skill","description":"Check code against the OWASP Top 10 (2021) with concrete detection patterns and fixes.","integrity":"sha256-5fddbf4a1e896229715ebe2577e3bf813334d61ea87ec80ff002f4ad6212d72a","tarball_url":"https://localhost:3000/api/v1/tarballs/crewd/owasp-top10/1.0.0","tarballUrl":"https://localhost:3000/api/v1/tarballs/crewd/owasp-top10/1.0.0","size_bytes":329,"hosts":["claude-code","cursor","gemini-cli"],"manifest":{"name":"@crewd/owasp-top10","type":"skill","entry":"SKILL.md","hosts":["claude-code","cursor","gemini-cli"],"schema":"https://crewd.dev/schema/skill/v1","content":"---\nname: owasp-top10\ndescription: \"Check code against the OWASP Top 10 (2021) with concrete detection patterns and fixes.\"\n---\n\n# Owasp Top10\n\nUse this skill when auditing or writing code that handles requests, auth, data or files.\n\n| # | Risk | Look for | Fix |\n| :--- | :--- | :--- | :--- |\n| A01 | Broken access control | Handlers that read IDs from the request without checking ownership/tenant; missing auth middleware; IDOR | Enforce authz server-side on every resource access; deny by default |\n| A02 | Cryptographic failures | MD5/SHA1 for passwords, homemade crypto, HTTP endpoints, secrets in repo | bcrypt/argon2 for passwords, TLS everywhere, secret manager |\n| A03 | Injection | String-built SQL, `exec`/`system` with user input, `innerHTML`, template `safe` filters | Parameterised queries, arg arrays, output encoding |\n| A04 | Insecure design | No rate limits on login/reset, unlimited uploads, trust in client-side checks | Threat-model flows; server-side limits |\n| A05 | Security misconfiguration | Debug mode in prod, permissive CORS `*` with credentials, default creds, verbose errors | Hardened defaults, env-specific config |\n| A06 | Vulnerable components | Outdated deps with CVEs | `npm audit`, `govulncheck`, `pip-audit`; upgrade |\n| A07 | Auth failures | Weak session handling, no MFA option, tokens in URLs, no expiry | Secure, HttpOnly, SameSite cookies; short-lived tokens |\n| A08 | Integrity failures | Unsigned updates, unsafe deserialisation (`pickle`, `yaml.load`) | Verify signatures; safe loaders |\n| A09 | Logging failures | No audit logs for auth events; logging secrets/PII | Structured audit logs, redaction |\n| A10 | SSRF | Fetching user-supplied URLs server-side | Allow-list hosts; block internal IP ranges |\n\n## Procedure\n\n1. Enumerate entry points (routes, webhooks, CLI args, file uploads, queue consumers).\n2. For each, walk A01→A10 and note findings with file:line.\n3. Rate severity: **Critical** (remote, unauthenticated), **High**, **Medium**, **Low**.\n4. Redact any discovered secret to its first 4 characters.\n","version":"1.0.0","description":"Check code against the OWASP Top 10 (2021) with concrete detection patterns and fixes."},"scripts":[],"dependencies":[],"deprecated":null,"created_at":"2026-10-18T17:02:35.347624+00:00"}