/ Каталог / Песочница / claude-code-owasp
← Все серверы ↗ GitHub
● Сообщество agamm ⚡ Сразу

claude-code-owasp

автор agamm · agamm/claude-code-owasp

OWASP best practices baked into Claude Code — Top 10:2025, ASVS 5.0, Agentic AI security, plus 20+ language-specific quirks.

Claude Code OWASP Skill teaches Claude to think like a security reviewer. It loads OWASP Top 10:2025 guidance, ASVS 5.0 verification standards, the new Agentic AI security guidance, and 20+ language-specific sections (JS/TS, Python, Rust, Go, Java, Ruby, etc.). Good for pre-commit review, PR review, and threat-modeling sessions.

▶ Смотреть демо 📦 Установить 💡 Сценарии

Зачем использовать

Ключевые функции

Живое демо

Как выглядит на практике

claude-code-owasp-skill.replay ▶ готово
0/0

Установка

Репозиторий автора · Официальная документация Claude Skills

Сценарии использования

Реальные сценарии: claude-code-owasp

How to security-review a PR with OWASP Top 10 in mind

👤 Developers doing self-review before requesting human review ⏱ ~20 min intermediate

Когда использовать: Before you click 'Ready for review' on a PR that touches auth, data, or input handling.

Поток
  1. Point at the diff
    Review the current PR against OWASP Top 10:2025. Focus on auth and input handling.✓ Скопировано
    → Findings mapped to Top 10 categories with line references
  2. Prioritize
    Group findings into 'must-fix before merge' vs 'follow-up issue'. Cite the specific ASVS requirement.✓ Скопировано
    → Ranked list with ASVS IDs
  3. Generate fixes
    For each must-fix, propose the minimal diff.✓ Скопировано
    → Patch diffs keyed to findings

Итог: A PR that ships with known security issues resolved, with traceable requirements.

Подводные камни
  • Over-alerting on benign patterns — Ask Claude to show the exploit path concretely; if it can't, downgrade the severity

Run a lightweight threat model on a new feature

👤 Engineers designing a feature involving user data ⏱ ~40 min advanced

Когда использовать: Design stage, before writing the code, when the blast radius is still negotiable.

Поток
  1. Describe the feature
    Feature: share-by-link for customer reports. Users generate tokenized URLs valid 7 days. Threat-model with OWASP agentic AI guidance included.✓ Скопировано
    → STRIDE-style list of threats
  2. Pick controls
    For each threat, what's the cheapest control that mitigates 80%?✓ Скопировано
    → Per-threat control + rejection rationale for expensive ones

Итог: A threat model document you can attach to the design doc.

Подводные камни
  • Over-engineered control list — Explicitly limit to top-5 threats by likelihood × impact

Harden an AI agent integration against prompt injection

👤 Engineers shipping Claude/LLM-powered features ⏱ ~30 min advanced

Когда использовать: You're about to let an LLM touch user data or call tools.

Поток
  1. Describe the agent surface
    Our agent reads support emails and can call 3 tools: refund(), tag_account(), escalate(). Review for agentic AI risks.✓ Скопировано
    → Prompt-injection vectors, tool-misuse risks, data exfil paths
  2. Design guardrails
    Propose a minimal guardrail set: which tools need human confirm, which inputs need sanitization, what logging is required.✓ Скопировано
    → Concrete guardrail spec

Итог: A hardened agent design with documented guardrails.

Подводные камни
  • Relying on prompt-based defenses alone — Combine with deterministic controls — human-in-loop for destructive tools, allowlists for URLs

Audit for language-specific security quirks

👤 Reviewers checking a codebase in a language they don't know deeply ⏱ ~15 min intermediate

Когда использовать: You're reviewing Python code as a TS native, or vice versa.

Поток
  1. Scope to language
    Review this Python module for Python-specific OWASP quirks (pickle, yaml.load, shell=True, etc.).✓ Скопировано
    → Language-specific findings beyond generic Top 10

Итог: Catches that a language-agnostic review would miss.

Комбинации

Сочетайте с другими MCP — эффект x10

claude-code-owasp-skill + claude-code-skill-factory-skill

Skill Factory wires OWASP checks as PreToolUse hooks for automatic gating

Use skill-factory /build hook to run OWASP review on every Write tool call in our repo.✓ Скопировано
claude-code-owasp-skill + seo-audit-skill

Overlap on security headers

Run seo-audit security category, then deeper OWASP review on the hits.✓ Скопировано
claude-code-owasp-skill + robotics-agent-skill

Secure ROS networking (rosbridge, Zenoh)

Robotics skill produced a rosbridge websocket — run OWASP review on it.✓ Скопировано

Инструменты

Что предоставляет этот MCP

ИнструментВходные данныеКогда вызыватьСтоимость
Top 10:2025 review diff or files PR self-review Claude tokens
ASVS requirement check feature spec Compliance work Claude tokens
Agentic AI threat model agent design Shipping LLM features Claude tokens
Language-specific audit language, files Cross-language review Claude tokens
Threat model (STRIDE) feature description Design phase Claude tokens

Стоимость и лимиты

Во что обходится

Квота API
None
Токенов на вызов
5-20k per review depending on code size
Деньги
Free
Совет
Scope reviews to changed files, not the whole repo.

Безопасность

Права, секреты, радиус поражения

Хранение учётных данных: No credentials
Исходящий трафик: Code is sent to Claude for inference

Устранение неполадок

Частые ошибки и исправления

Claude ignores OWASP context and gives generic advice

Explicitly name the guidance: 'Apply OWASP Top 10:2025 category A03:2025 Injection here.'

Too many false positives

Require an exploit walkthrough before accepting a finding

Альтернативы

claude-code-owasp в сравнении

АльтернативаКогда использоватьКомпромисс
Semgrep / SnykYou want deterministic static analysis in CIDifferent strengths; combine both

Ещё

Ресурсы

📖 Читать официальный README на GitHub

🐙 Открытые задачи

🔍 Все 400+ MCP-серверов и Skills