Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add georgekhananaev/claude-skills-vault --skill owasp-securitygit clone --depth 1 https://github.com/georgekhananaev/claude-skills-vaultWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/georgekhananaev/claude-skills-vault/owasp-security)<a href="https://agentmods.dev/skills/georgekhananaev/claude-skills-vault/owasp-security"><img src="https://agentmods.dev/badge/skills/georgekhananaev/claude-skills-vault/owasp-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/georgekhananaev/claude-skills-vault/owasp-security"><img src="https://agentmods.dev/badge/skills/georgekhananaev/claude-skills-vault/owasp-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.04033 |
| Opus 5 | $0.00026 | $0.02017 |
| Sonnet 5 | $0.00011 | $0.00807 |
| Haiku 4.5 | $0.00005 | $0.00403 |
Grade A, and why
owasp-security scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
6. **Standard Library:** Historic CVEs in std libs (Python urllib, Java XML, Ruby OpenSSL). Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
os.system(f"convert {filename} output.png") How it starts
The opening of the file, as written. The whole thing — 535 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OWASP Security Best Practices Skill
Apply these security standards when writing or reviewing code.
Quick Reference: OWASP Top 10:2025
| # | Vulnerability | Key Prevention |
|---|---|---|
| A01 | Broken Access Control | Deny by default, enforce server-side, verify ownership |
| A02 | Security Misconfiguration | Harden configs, disable defaults, minimize features |
| A03 | Supply Chain Failures | Lock versions, verify integrity, audit dependencies |
| A04 | Cryptographic Failures | TLS 1.2+, AES-256-GCM, Argon2/bcrypt for passwords |
| A05 | Injection | Parameterized queries, input validation, safe APIs |
| A06 | Insecure Design | Threat model, rate limit, design security controls |
| A07 | Auth Failures | MFA, check breached passwords, secure sessions |
| A08 | Integrity Failures | Sign packages, SRI for CDN, safe serialization |
| A09 | Logging Failures | Log security events, structured format, alerting |
| A10 | Exception Handling | Fail-closed, hide internals, log with context |
Security Code Review Checklist
When reviewing code, check for these issues:
Input Handling
- All user input validated server-side
- Using parameterized queries (not string concatenation)
- Input length limits enforced
- Allowlist validation preferred over denylist
Authentication & Sessions
- Passwords hashed with Argon2/bcrypt (not MD5/SHA1)
- Session tokens have sufficient entropy (128+ bits)
- Sessions invalidated on logout
- MFA available for sensitive operations
Access Control
- Authorization checked on every request
- Using object references user cannot manipulate
- Deny by default policy
- Privilege escalation paths reviewed
Data Protection
- Sensitive data encrypted at rest
- TLS for all data in transit
- No sensitive data in URLs/logs
- Secrets in environment/vault (not code)
Error Handling
- No stack traces exposed to users
- Fail-closed on errors (deny, not allow)
- All exceptions logged with context
- Consistent error responses (no enumeration)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 535 lines · 53 tokens per session scan A 5db1089092e3
owasp-security is a skill published in the GitHub repository georgekhananaev/claude-skills-vault (28 stars, last pushed 1mo ago), licensed MIT. It adds 53 tokens to every session and 4,033 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
woocommerce-health-check
Use when the user says 'why is my checkout broken', 'audit my woocommerce store', 'cart problems woocommerce', or 'losing sales woocommerce'. Diagnoses checkout and cart failures, AJAX mismatches, caching conflicts, payment gateway setup, and SSL enforcement.
mobile-experience-report
Use when the user says 'my site looks bad on mobile', 'check mobile layout', 'responsive audit', or 'site broken on phones'. Diagnoses breakpoint problems, text sizing, column stacking failures, hidden elements, and navigation menu behavior, device by device.
content-portability
Use when the user says 'export my site', 'backup my pages before editing', 'download my content locally', or 'migrate content to my other site'. Exports pages, posts, and custom posts to portable local packages with builder data, media, and markdown, then imports elsewhere with ID remapping.
migrate-divi-to-breakdance
Use when the user says 'migrate divi to breakdance', 'convert divi to breakdance', or 'rebuild divi pages in breakdance'. Parses Divi shortcodes, maps modules to Breakdance elements, and creates draft duplicates for review.
migrate-divi-to-bricks
Use when the user says 'migrate divi to bricks', 'convert divi to bricks', or 'rebuild divi pages in bricks'. Parses Divi shortcode content, maps modules to Bricks elements, and generates draft duplicates for review.
migrate-divi-to-gutenberg
Use when the user says 'migrate divi to gutenberg', 'convert divi to blocks', 'get off divi', or 'decommission divi'. Parses Divi shortcodes, maps modules to core blocks, and creates draft duplicates for review.