Compatible with Cursor, Claude Code, Cline, Roo Code, Antigravity

Application Security & OWASP Top 10 Audit

Audit backend and frontend code for injection, authentication flaws, IDOR, SSRF, and sensitive data leakage.

SecurityOWASPAuthBackendAppSec

v1.1.0 · Updated 2026-08

Skill Objective

Perform white-box application security audits to discover vulnerabilities across the OWASP Top 10, CWE standards, and cloud configurations.

Execution Workflow Procedure

Ordered steps the coding agent executes when performing this skill.

Inspect Input Boundaries & Injection Risks

Check all dynamic query construction (SQLi, NoSQLi), command executions, and outbound URLs (SSRF) for parameterization and sanitization.

Verify Access Control & IDOR

Ensure that every database read and write by ID validates tenant isolation and user ownership.

Audit Authentication & Session Secrets

Check token validation, timing-safe hash comparisons, secret key rotation, and cookie flags (HttpOnly, SameSite, Secure).

Provide Proof of Concept & Remediation

Construct realistic attack scenarios demonstrating exploitability and provide defense-in-depth patches.

Agent Safety Guardrails & Anti-Hallucination Rules

DO NOT suggest client-side only security checks as substitutes for server-side authorization.
DO NOT recommend insecure legacy hashing algorithms (MD5/SHA1).

Expected Output Format

CWE-tagged vulnerability summary matrix with proof of concepts.

🛡️ Vulnerability Matrix: Type, Severity, CWE ID, Affected File.

💥 Exploit Scenario / PoC: How an attacker could exploit this flaw.

🔒 Patched Code: Hardened, defense-in-depth replacement implementation.

Domain Verification Checks

IDOR Authorization: Verifies tenant context in all database queries.

SSRF Protection: Restricts outbound HTTP calls to public whitelists.

Timing-Safe Comparison: Uses constant-time comparison for signatures and hashes.

Example Agent Invocations

"Audit this document download endpoint for IDOR and path traversal vulnerabilities."

"Check this authentication middleware for JWT signature validation and timing attacks."

Install / Configure This Skill

# Place in .cursorrules or create .cursor/rules/application-security-owasp-audit.mdc
# Trigger: Whenever you perform application security & owasp top 10 audit

---
name: application-security-owasp-audit
description: Perform white-box application security reviews checking for OWASP Top 10 flaws, IDOR, injection, and authentication bypasses.
version: 1.1.0
compatibility: [Cursor, Claude Code, Cline, Roo Code, Antigravity]
---

# Application Security & OWASP Top 10 Audit

## Objective
Discover and remediate security vulnerabilities across application source code, API routes, and authentication layers.

## Workflow
1. **Injection & SSRF**: Verify parameterized database queries and validate outbound HTTP destinations.
2. **Broken Access Control (IDOR)**: Ensure tenant and user authorization on all entity lookups by ID.
3. **Authentication & Cryptography**: Validate constant-time comparison on hashes, JWT claims, and secure cookie attributes.
4. **Remediation**: Provide patched code implementing defense-in-depth practices.

Complementary Agent Prompt

Need a quick one-time prompt for chat?

Try the Security Vulnerability & OWASP Code Audit — a lightweight version designed for 1-click copying directly into Claude, ChatGPT, or Cursor chat.

View Prompt