code-security-skills

Plugin code-security-skills from marketplace agent-security-playbook in OWASP/secure-agent-playbook. Commands read from the repo's manifest — 28 days ago.

Skills (11)

• api-security-review

  Comprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting,

• code-review-security

  Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization.

• iac-security-review

  Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation). Use when reviewing IaC files for misconfigurations, overpermissioning, exposed resources, missing encryption, secrets in code, and supply chain risks. Covers CIS benchmarks and cloud security best practices.

• mobile-code-review

  Security-focused review of native Android and iOS mobile app source code against OWASP MASVS v2.1.0. Use when reviewing mobile codebases, mobile PR diffs, or auditing a mobile module.

• prd-securability-enhancement

  Enhance PRDs, feature specs, user stories, or product briefs with explicit OWASP ASVS coverage and FIASSE v1.0.4 SSEM implementation guidance — before code is written. Trigger on "harden the PRD/spec", "choose ASVS level", "map features to ASVS", "find missing security requirements", "add NFRs for s

• sca-audit

  Scan project dependencies for known vulnerabilities (CVEs). Use when reviewing dependency files (package.json, requirements.txt, go.mod, pom.xml, Gemfile, Cargo.toml, etc.), triaging Dependabot/Renovate alerts, or performing pre-deployment security checks.

• secrets-scan

  Detect hardcoded credentials, API keys, tokens, and secrets in source code and configuration files. Use when reviewing code for leaked secrets before commit/merge, auditing a repository for credential exposure, or setting up secret detection.

• securability-engineering-review

  Score a codebase, file, or merge request against the FIASSE v1.0.4 SSEM model — 0-10 per attribute, equal-weighted pillars, evidence-backed strengths and weaknesses, prioritized recommendations, 50-item checklist appendix. Trigger on "review/score/audit securability", "SSEM scorecard", "FIASSE/SSEM

• securability-engineering

  Generate, scaffold, or refactor code so it embodies FIASSE v1.0.4 SSEM qualities by default — 10 attributes, Transparency and Least-Astonishment principles, ASVS-aligned controls, defensive boundary handling. Trigger on "secure/securable/FIASSE-compliant code", "harden", "secure-by-default", "audit-

• security-guidance

  Security-first development guidance based on OWASP ASVS (Application Security Verification Standard). Use this skill automatically when planning or implementing any code that touches user input, authentication, data persistence, network communication, file I/O, cryptography, or access control. This

• web-security-review

  Review web applications against the OWASP Top 10 for Web Applications (2021). Use when auditing web apps, reviewing server-side code, or assessing web frameworks for the classic OWASP Top 10 risks including injection, broken auth, and XSS.

Subagents (5)

• api-security-reviewer

  Performs comprehensive API security assessment against the OWASP API Security Top 10. Use when reviewing REST, GraphQL, or gRPC APIs, OpenAPI specs, or API gateway configurations.

• code-security-reviewer

  Performs code-level vulnerability analysis — security code review, secrets scanning, and web application security assessment. Use when you need a comprehensive code security review of a codebase, PR, or module.

• dependency-auditor

  Audits project dependencies for known CVEs, supply chain risks, and dependency health issues. Use when you need to assess third-party library risk across all ecosystems in a project.

• mobile-security-reviewer

  Performs security review of native Android and iOS source code against OWASP MASVS v2.1.0. Use when reviewing a mobile codebase, a mobile PR, or auditing a mobile module.

• security-team-lead

  Coordinates a team of specialist security agents for comprehensive, parallel security assessments. Use when you want a full-scope security review that covers code, dependencies, APIs, and AI/agent risks simultaneously.

Similar plugins