OWASP skill for Claude Code: security-review your code against the OWASP Top 10:2025 (tested)

claude-code-owasp is a Claude Code skill that teaches it to review code against the current OWASP standards: the Top 10:2025, ASVS 5.0, the Top 10 for LLM Applications (2026) and the Top 10 for Agentic Applications (2026). It installs as a plugin with two commands and loads itself whenever you ask for a security review. It is MIT licensed.

This article covers what it ships, how to install it and what it actually changes in a review. We tested it in Claude Code 2.1.314 with Sonnet 5.5 on two files with planted bugs (a Flask invoices API and a support agent that runs shell commands), then ran the same review without the skill to compare.

If skills are new to you, read the Claude Code skills guide first.

What claude-code-owasp is

It is a repository by Agam More (agamm/claude-code-owasp) holding a single skill, owasp-security, also packaged as a Claude Code plugin. We reviewed commit 8ac7965 from September 24, 2026.

Its main selling point is accurate references. OWASP changed a lot between 2021 and 2026, and much of the material online (and in model training data) still uses old names and IDs:

• The Top 10:2025 renamed three categories and added two: A03 *Software Supply Chain Failures* and A10 *Mishandling of Exceptional Conditions*. SSRF no longer has its own category; it is part of A01 *Broken Access Control*.
• ASVS 5.0 (May 2025) renumbered every chapter. A 4.0 V2.1.1 does not mean the same thing in 5.0.
• The LLM Top 10 2026 reordered eight of its ten risks. *Excessive Agency* moved from LLM06 to LLM03 and *Improper Output Handling* from LLM05 to LLM10, for example. The skill ships a translation table and requires every ID to be written with its name ("LLM03 Excessive Agency") so there is no ambiguity.

The author says names and IDs were checked against the official sources (owasp.org, the ASVS repository and the LLM Top 10 2026 PDF) rather than paraphrased.

What the skill includes

It follows Anthropic's recommended layout: a short SKILL.md with what the model would otherwise get wrong, plus reference files loaded only when needed.

Two pieces of SKILL.md do most of the work:

The "before reporting a finding" rubric. Before calling something a vulnerability, Claude must confirm four things: the input is attacker-controlled, it reaches the dangerous sink with no control in between, the blast radius, and that the attacker can perform every step. If it cannot confirm them, the finding drops to "Needs verification". This targets the biggest problem with automated reviews: long lists of false positives that bury what matters.

A fixed report format. Each finding comes with severity, title, CWE and OWASP IDs, file and line, the path from input to sink, impact, fix and a confidence level. Severity is rated by exploitability, not by pattern, and the skill explicitly says not to pad the report with "Info" items to look thorough.

How to install it

As a plugin (recommended)

Inside Claude Code:

/plugin marketplace add agamm/claude-code-owasp
/plugin install owasp-security@agamm

Third-party marketplaces do not auto-update. To update by hand:

claude plugin marketplace update agamm
claude plugin update owasp-security@agamm

Or turn on auto-update once: /plugin, Marketplaces tab, select agamm and choose Enable auto-update.

As a plain skill

The skill is a folder, not a single file, so copy all of it. With degit, for the current project only:

npx degit agamm/claude-code-owasp/.claude/skills/owasp-security .claude/skills/owasp-security

Or for all your projects:

npx degit agamm/claude-code-owasp/.claude/skills/owasp-security ~/.claude/skills/owasp-security

Try it without installing

For our test we cloned the repository and loaded it for one session with --plugin-dir, which leaves your configuration untouched:

git clone --depth 1 https://github.com/agamm/claude-code-owasp
cd my-project
claude --plugin-dir ../claude-code-owasp

Before installing any third-party skill, read it or run it through a scanner. This repository is only Markdown (plus a Node test script that does not run when you use the skill), but the habit matters: see our SkillSpector article.

How to use it

There is no command to remember. Claude Code loads the skill when your request matches its description: "security review", "is this secure", "audit this", "threat model", "prompt injection", "MCP server security", "secrets in code" or "harden this Dockerfile". It also triggers when you implement authentication, sessions, cryptography or LLM features.

Prompts that work well:

Do a security review of this diff before I merge it.
Is this login and session implementation secure?
Check this agent against the OWASP agentic risks.
Harden this Dockerfile and the GitHub Actions workflow.

During a review it copies a five-step checklist into its answer and ticks it off: map entry points and trust boundaries, load the references it needs, sweep for candidates, triage each one and write the report.

Real test: the same review with and without the skill

We set up a repository with two Python files (identifiers in Spanish, as in our audience's code):

• facturas.py: a Flask API with two routes behind @login_required. The list route sorts with an f-string in ORDER BY, but the column comes from an allowlist (a decoy: it looks like SQL injection and is not). The detail route /api/facturas/<id> looks the invoice up by id only, without checking the owner (a real IDOR).
• agente_soporte.py: an agent that reads a customer email, passes it to Claude and runs whatever command the model asks for with subprocess.run(..., shell=True).

Both cases are adapted from the repository's own evals. We ran the same prompt headless, with read-only tools:

claude -p "Haz una revisión de seguridad de facturas.py y agente_soporte.py antes de que lo fusione." \
  --plugin-dir ../claude-code-owasp \
  --allowedTools "Read,Glob,Grep,Skill"

Claude loaded the skill first, read both files and the checklist, and returned this (in Spanish, because we asked in Spanish):

Then we ran exactly the same thing without --plugin-dir:

What we learned

• Sonnet 5.5 already finds the bugs without the skill. Both reviews caught the remote command execution (critical), the IDOR (high) and the unbounded loop, and neither fell for the ORDER BY decoy. If you expect the skill to uncover bugs the model cannot see, on code like this it does not.
• What it adds is the report. With the skill, each finding has a CWE, an OWASP 2025 category and named LLM 2026 and agentic IDs, the exact input-to-sink path, the line and an explicit confidence level. Without it, the explanation is good but in prose, with no references you can paste into a ticket, an audit or a client report.
• Less padding. Without the skill the report added two "low" findings and a robustness note that is not about security. With it, it stuck to three real findings, as its rubric asks.
• It costs a bit more. The skill adds context: the review cost $0.134 versus $0.085, in the same 32 seconds. On a large PR the gap grows, because it reads more reference files.

The author measures the same thing: the repository ships five evals for claude plugin eval that score each case with and without the skill, including one that requires no false positives on safe code and one that checks the skill does not trigger on unrelated requests. If you modify it, you can measure whether it got better or worse:

claude plugin eval .
claude plugin eval . --model opus

Each run makes real model calls billed to your account (the author estimates about $2-3 per model for the full suite).

When it is worth it

• You review code headed to production and document it. If you hand reports to clients or need traceability (CWE, OWASP, ASVS), the fixed format saves rewriting every finding.
• You build agents or LLM features. The LLM Top 10 2026 and Agentic Top 10 tables are what changed most and what models know worst. Getting "LLM03 Excessive Agency" or "ASI05 Unexpected Code Execution" right avoids mixing them up with the 2025 edition.
• You target a specific ASVS level. The skill summarizes level 1 and 2 requirements with their real 5.0 IDs (for example, passwords of at least 8 characters in 6.2.1, and the fact that all security logging starts at L2).

It does not replace a full audit. To sweep a whole repository with several agents that hunt and try to disprove bugs, see Cloudflare's security-audit; for automatic review of every PR in CI, the Open Code Review guide. claude-code-owasp works as a knowledge layer: it loads itself when you write or review sensitive code and makes what Claude says precise and citable.

Common errors

The skill does not trigger. Check the plugin is installed with /plugin and ask using words from its description ("security review", "is this secure", "OWASP"). If you installed the plain skill, the folder must end up at .claude/skills/owasp-security/SKILL.md, not one level deeper.

You copied only SKILL.md. It half works: step 3 asks to read reference/review-checklist.md and the language files. Copy the whole folder with degit or cp -r.

You get no updates. Third-party marketplaces do not auto-update. Run claude plugin marketplace update agamm and claude plugin update owasp-security@agamm, or enable *Enable auto-update*, then /reload-plugins.

The report cites LLM06 for "Excessive Agency". That is the 2025 numbering. The skill enforces the 2026 one (LLM03) with the name next to it; if you see old IDs, the skill probably did not load in that session.

FAQ

Is it free? Yes. The skill is MIT licensed. You pay for the model tokens used by the review.

Does it work with Codex, Cursor or other agents? SKILL.md is an open format, so the folder can be used by other agents that read skills. The plugin and the evals are Claude Code specific.

Does it run code or scan dependencies? No. It is knowledge and instructions in Markdown: Claude reads your code and reasons about it. It does not run analysis tools or query vulnerability databases.

Which model should I use? The author designs and measures the skill for Sonnet and Opus. It is not evaluated on small models.

Conclusion

claude-code-owasp does not make Claude a better bug hunter: a current model already finds the bugs. What it does is make the result use the correct OWASP 2025-2026 vocabulary, explain the attack path, state its confidence and skip the padding. If you review code for production or for clients, it installs in two commands and is worth the small extra cost. Next step: pair it with a safe skill-install flow, searching with find-skills and scanning with SkillSpector before adding any other skill.