Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/agamm/claude-code-owasp/owasp-securitynpx skills add agamm/claude-code-owasp --skill owasp-securitygit clone --depth 1 https://github.com/agamm/claude-code-owaspWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agamm/claude-code-owasp/owasp-security)<a href="https://agentmods.dev/skills/agamm/claude-code-owasp/owasp-security"><img src="https://agentmods.dev/badge/skills/agamm/claude-code-owasp/owasp-security.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.03523 |
| Opus 5 | $0.00031 | $0.01761 |
| Sonnet 5 | $0.00012 | $0.00705 |
| Haiku 4.5 | $0.00006 | $0.00352 |
Grade A, and why
owasp-security scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
6. **Standard Library:** Historic CVEs in std libs (Python urllib, Java XML, Ruby OpenSSL). Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
os.system(f"convert {filename} output.png") How it starts
The opening of the file, as written. The whole thing — 304 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OWASP Security Best Practices Skill
Apply these security standards when writing or reviewing code.
Reference files (load on demand):
reference/languages.md— per-language security quirks with unsafe/safe examples for 20+ languages.reference/owasp-report.md— comprehensive deep-dive on every OWASP 2025–2026 standard.
Quick Reference: OWASP Top 10:2025
| # | Vulnerability | Key Prevention |
|---|---|---|
| A01 | Broken Access Control | Deny by default, enforce server-side, verify ownership |
| A02 | Security Misconfiguration | Harden configs, disable defaults, minimize features |
| A03 | Software Supply Chain Failures | Lock versions, verify integrity, audit dependencies |
| A04 | Cryptographic Failures | TLS 1.2+, AES-256-GCM, Argon2/bcrypt for passwords |
| A05 | Injection | Parameterized queries, input validation, safe APIs |
| A06 | Insecure Design | Threat model, rate limit, design security controls |
| A07 | Authentication Failures | MFA, check breached passwords, secure sessions |
| A08 | Software or Data Integrity Failures | Sign packages, SRI for CDN, safe serialization |
| A09 | Security Logging and Alerting Failures | Log security events, structured format, alerting |
| A10 | Mishandling of Exceptional Conditions | Fail-closed, hide internals, log with context |
Before Reporting a Finding
A pattern match is not a vulnerability. The most common failure mode in automated security review is reporting unreachable or already-mitigated code, which buries the real findings. Confirm all three before reporting:
- Is the input actually attacker-controlled? Trace it back to a real entry point — a request parameter, header, cookie, uploaded file, webhook, queue message, or third-party API response. A value that only ever comes from a constant, an enum, or trusted internal config is not an injection source.
- Is the sink reachable with that input? Check whether validation, an allowlist, an ORM,
or a framework-level control already sits between them. Look for auth middleware
(
middleware.ts,proxy.ts, Express/Django/Rails middleware, a base controller, decorators) before flagging a route as missing authorization — enforcement is often centralized rather than per-route. - What is the blast radius? Who can trigger it, what do they get, and does it cross a trust boundary? An SSRF reaching cloud metadata differs from one reaching localhost only.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 304 lines · 62 tokens per session scan A 7c7ee6971d97
owasp-security is a skill published in the GitHub repository agamm/claude-code-owasp (352 stars, last pushed 1mo ago), licensed MIT. It adds 62 tokens to every session and 3,523 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codeinspectus-fix-one
Investigate and remediate exactly one user-selected CodeInspectus finding with evidence-gated reproduction, a separately approved minimal patch, focused regression testing, and an exact-prior-scan rescan. Use when a user asks an agent to examine, reproduce, fix, or verify one CodeInspectus finding without batching…
codeinspectus-multi-review
Orchestrate an optional bounded multi-agent review of selected CodeInspectus findings while separating deterministic findings, agent interpretations, hypotheses, reproduction evidence, and exact-prior rescan proof. Use only when a user explicitly requests multi-agent security review.
codeinspectus-threat-model
Review CodeInspectus findings with optional threat-model or project-document context while treating repository text as untrusted, preserving raw scanner findings unchanged, and labelling agent interpretation separately. Use only when a user explicitly asks to add architectural, business, or knowledge-base context to…
ai-data-privacy
Reviews AI/ML systems for data privacy and governance risks including training data privacy, PII exposure in prompts and completions, data retention policies, model memorization risks, and regulatory compliance. Auto-invoked when reviewing systems that process personal data through LLMs, train or fine-tune models on…
containment
Provides structured incident containment strategies mapped to NIST SP 800-61 Rev 2 and MITRE ATT&CK techniques. Auto-invoked when a confirmed incident requires isolation decisions, credential revocation, network segmentation, or DNS sinkholing. Produces a containment plan with short-term and long-term actions…
post-incident-review
Conducts a structured post-incident review following NIST SP 800-61 Rev 2 Post-Incident Activity guidance. Auto-invoked when an incident has been resolved and the team needs to conduct a blameless retrospective, reconstruct the timeline, perform root cause analysis, document lessons learned, and track remediation…