The OWASP Foundation
OWASP's skills help an AI agent review API specifications and implementations against the OWASP API Security Top 10, audit dependency manifests such as package.json, requirements.txt and go.mod for known CVEs, and review native Android and iOS code against MASVS. They also cover threat modeling for multi-agent systems, scoring codebases for securability, and testing LLM-integrated applications for prompt injection.
Secure Agent Playbook
20 skills · 212 stars · NOASSERTION
Agent Security Audit Audit AI agent configurations for security risks — excessive permissions, prompt injection surfac…
Agentic Ai Risk Assess Assess agentic AI applications against the OWASP Top 10 for Agentic Applications 2026.
Ai Security Verification Comprehensive AI security verification using OWASP AI Security Verification Standard (AISVS) fram…
Api Security Review Comprehensive API security review against OWASP API Security Top 10 (2023).
Code Review Security Security-focused code review mapped to OWASP Top 10 and ASVS.
Iac Security Review Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation).
Llm Risk Assess Comprehensive LLM security assessment against OWASP Top 10 for LLM Applications 2025.
Mcp Server Review Security review of MCP (Model Context Protocol) server implementations and configurations.
Mobile Code Review Security-focused review of native Android and iOS mobile app source code against OWASP MASVS v2.1.0.
Multi Agentic Threat Model Comprehensive threat modeling for multi-agent systems using CSA MAESTRO 7-layer framework and OWA…
Multi Agentic Threat Model Comprehensive threat modeling for multi-agent systems using CSA MAESTRO 7-layer framework and OWA…
Prd Securability Enhancement Enhance PRDs, feature specs, user stories, or product briefs with explicit OWASP ASVS coverage an…
Prompt Injection Test Test LLM-integrated applications against known prompt injection techniques, evasion methods, and…
Sca Audit Scan project dependencies for known vulnerabilities (CVEs).
Secrets Scan Detect hardcoded credentials, API keys, tokens, and secrets in source code and configuration files.
Securability Engineering Generate, scaffold, or refactor code so it embodies FIASSE v1.0.4 SSEM qualities by default — 10…
Securability Engineering Review Score a codebase, file, or merge request against the FIASSE v1.0.4 SSEM model — 0-10 per attribut…
Security Guidance Security-first development guidance based on OWASP ASVS (Application Security Verification Standa…
Web Security Review Review web applications against the OWASP Top 10 for Web Applications (2021).
Your Skill Name Replace with a clear description of what this skill does.