owasp-check

What this skill does

Inspects security controls of a target application against the OWASP Top 10 2021 standard. Queries the defense status for each of the 10 categories (A01–A10) and generates a Pass/Fail/N-A compliance matrix. Provides prioritized remediation recommendations with official OWASP reference links for each failed item.

When to use

• When conducting an application security review or pre-release inspection
• When performing an OWASP-based self-assessment in preparation for a security audit
• When systematically communicating security requirements to a development team
• When identifying risk priorities before a penetration test

Prerequisites

• No external tools required (checklist-based)
• Inspector's knowledge of the target application's technology stack

Inputs

Item	Description	Example
APP_NAME	Name of the application under review	MyWebApp v2.3
APP_TYPE	Application type	web / api / mobile
TECH_STACK	Technology stack in use (optional)	Node.js, PostgreSQL, React

Workflow

Step 1: Collect target application information

APP_NAME="${SECSKILL_APP_NAME:-}"
if [ -z "$APP_NAME" ]; then
  read -rp "Application name: " APP_NAME
fi
APP_TYPE="${SECSKILL_APP_TYPE:-}"
if [ -z "$APP_TYPE" ]; then
  read -rp "Type (web/api/mobile): " APP_TYPE
fi
TECH_STACK="${SECSKILL_TECH_STACK:-}"
if [ -z "$TECH_STACK" ]; then
  read -rp "Tech stack (e.g. Node.js, PostgreSQL): " TECH_STACK
fi

REPORT_FILE="/tmp/owasp_check_$(date +%Y%m%d_%H%M%S).md"
echo "# OWASP Top 10 2021 Inspection Results" > "$REPORT_FILE"
echo "" >> "$REPORT_FILE"
echo "- **Target**: $APP_NAME" >> "$REPORT_FILE"
echo "- **Type**: $APP_TYPE" >> "$REPORT_FILE"
echo "- **Stack**: $TECH_STACK" >> "$REPORT_FILE"
echo "- **Date**: $(date '+%Y-%m-%d')" >> "$REPORT_FILE"
echo "" >> "$REPORT_FILE"
echo "[+] Report file initialized: $REPORT_FILE"

Step 2: Query each OWASP Top 10 2021 category

Reference: See REFERENCE.md for the full OWASP Top 10 2021 checklist (10 categories, 35 questions, reference URLs, and remediation priority guide).