---

name: owasp-security-review description: Security review and implementation support based on OWASP Cheat Sheet Series. Use for code review requests, security-related implementation/research, and vulnerability checks. Covers security topics such as XSS, SQL Injection, CSRF, and authentication/authorization. compatibility: os: [darwin, linux] requirements: - git - network-access allowed-tools:

• shell_command

---

OWASP Security Review

Perform code security reviews based on the OWASP Cheat Sheet Series, identifying vulnerabilities and providing remediation recommendations.

Setup

If the Cheat Sheet repository has not been cloned:

Copybash scripts/setup_cheatsheets.sh

By default, it clones to ~/.local/share/owasp-cheatsheets.

Review Workflow

1. Identify Security Concerns

Identify relevant security categories from the code:

2. Load Relevant Cheat Sheets

Refer to top10-mapping.md to identify the applicable Cheat Sheets.

Load a Cheat Sheet:

Copycat ~/.local/share/owasp-cheatsheets/cheatsheets/<CheatSheet_Name>.md

3. Review and Report

Output Format for Code Review

Copy## Security Review Summary

### Findings

#### [Severity: Critical/High/Medium/Low] Finding Title
- **Location**: file:line
- **Issue**: Description of the problem
- **OWASP Category**: A0X: Category Name
- **Reference**: Cheat Sheet name
- **Recommendation**: Remediation with code examples

Output Format for Implementation/Research

Present implementation guidance or research findings based on Cheat Sheet content. Always cite the source Cheat Sheet.

Quick Reference

Common Vulnerabilities Checklist

• SQL/NoSQL Injection: Use parameterized queries
• XSS: Output encoding, CSP
• CSRF: Token validation
• Authentication: Strong password policy, MFA
• Session: Secure settings, appropriate expiration
• Access Control: Consistent authorization checks
• Secrets: No hardcoded secrets
• File Upload: File type validation, storage location
• Error Handling: Prevent information leakage
• Logging: Exclude sensitive information