Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add siva01c/claude-plugins --skill owasp-asvsgit clone --depth 1 https://github.com/siva01c/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/siva01c/claude-plugins/owasp-asvs)<a href="https://agentmods.dev/skills/siva01c/claude-plugins/owasp-asvs"><img src="https://agentmods.dev/badge/skills/siva01c/claude-plugins/owasp-asvs.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.04377 |
| Opus 5 | $0.00020 | $0.02188 |
| Sonnet 5 | $0.00008 | $0.00875 |
| Haiku 4.5 | $0.00004 | $0.00438 |
Grade A, and why
owasp-asvs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- graphite-setup — 86% identical, 472 lines differ
How it starts
The opening of the file, as written. The whole thing — 407 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ASVS Security Verification Skill
Reference: OWASP ASVS v5.0.0 — cross-reference IDs against https://github.com/OWASP/ASVS for the authoritative source.
When This Activates
- Performing security code reviews
- Implementing security features
- Responding to security review findings
- Security compliance verification
ASVS Requirements Checklist
V1 — Encoding and Sanitization (Critical)
| ID | Requirement | Drupal Validation |
|---|---|---|
| V1.1.1 | Output encoding for HTTP/HTML context | Twig auto-escape or #plain_text |
| V1.1.2 | Dynamic URL building with encoding | Url::fromRoute(), never string concat |
| V1.1.3 | JavaScript/JSON encoding | Json::encode() before output |
| V1.1.4 | SQL injection prevention | Parameterized queries only |
| V1.1.5 | OS command injection prevention | Avoid shell_exec, exec, system |
| V1.1.6 | LDAP injection prevention | Use parameterized LDAP queries |
| V1.1.7 | Regex metacharacter escaping | preg_quote() on user input |
| V1.2.1 | HTML sanitization | Xss::filter() or Xss::filterAdmin() |
| V1.2.2 | No eval() with user input |
Avoid eval(), use Json::decode() |
| V1.2.3 | SSRF prevention | Validate URLs against explicit allowlist |
V2 — Validation
| ID | Requirement | Drupal Validation |
|---|---|---|
| V2.1.1 | Input validation at server | Validate all user input server-side |
| V2.1.2 | Server-side validation only | Never trust client-only validation |
| V2.2.1 | Positive validation (allowlist) | Use \Drupal\Component\Utility\Html::escape() for plain text |
| V2.3.1 | Anti-automation / rate limiting | Flood control or custom rate limit service |
V3 — Web Frontend Security
| ID | Requirement | Drupal Validation |
|---|---|---|
| V3.1.1 | Cookie Secure attribute | ini_set('session.cookie_secure', TRUE) |
| V3.1.2 | Cookie SameSite attribute | session.cookie_samesite = Lax in settings.php |
| V3.1.3 | Cookie HttpOnly | session.cookie_httponly = TRUE |
| V3.2.1 | HSTS header | Strict-Transport-Security response header |
| V3.2.2 | CORS allowlist | Validate Origin; never use wildcard |
| V3.2.3 | CSP header | Content-Security-Policy response header |
| V3.2.4 | X-Content-Type-Options | nosniff |
| V3.2.5 | Referrer-Policy | Set appropriate policy |
| V3.2.6 | frame-ancestors | Prevent clickjacking via CSP or X-Frame-Options |
| V3.3.1 | CSRF protection | Form API tokens (automatic) or CsrfTokenGenerator for custom endpoints |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 407 lines · 41 tokens per session scan A ebeba7351e7f
owasp-asvs is a skill published in the GitHub repository siva01c/claude-plugins (16 stars, last pushed 1mo ago), licensed MIT. It adds 41 tokens to every session and 4,377 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
iflytek-hyper-tts
A text-to-speech tool that turns written text into an MP3 recording. It can use an authorized voice and adjust speaking speed, volume, and pitch.
iflytek-ocr-invoice
An image-reading tool that extracts structured information from Chinese invoices, receipts, bills, and tickets. OCR means turning text in a photo or scan into computer-readable data.
iflytek-pdf-image-ocr
AI-powered OCR service for images and PDF documents using iFlytek's advanced recognition APIs.
iflytek-voiceclone-tts
A tool for creating a speech model from recorded audio and then generating speech that uses the cloned voice. Voice cloning means training software to imitate a person’s voice.
animated-sketch-diagram
A tool for making animated diagrams and flowcharts in a hand-drawn ink style, with paper-like backgrounds, simple icons, and moving dots along connections. It produces a self-contained HTML file and can also create a looping GIF.
iflytek-text-proofread
A tool that checks Chinese writing through iFlytek’s official document-proofreading service. It looks for spelling, punctuation, wording, factual, terminology, and sensitive-content problems.