OWASP Security Review — a Claude Code Skill

A plug-in Claude Code skill that runs a launch-gate security review against the OWASP Top 10 (2025) on a Next.js + Supabase + OpenAI codebase — and explains every finding in plain language, so a non-coder can act on it.

It was purpose-built for the Vibe CRM Security Lab (a deliberately-vulnerable teaching CRM), but the methodology and the per-category checklist work as a general OWASP-2025 review for any modern Next.js App Router + Supabase app.

TL;DR — Type /owasp-security-review in Claude Code. It maps all 10 OWASP 2025 risks to the exact files in your repo, rates severity, and points at the concrete fix — no security jargon required.

---

Why this exists

Most “AI security review” is generic: it lists the OWASP Top 10 and hand-waves. This skill is the opposite — it is grounded in one real codebase. Every finding names a real file, a real line of reasoning, and (where the lab provides one) the correct version already sitting next to the broken one.

It’s written for an owner who prompts but doesn’t read code. So instead of “IDOR on the contact endpoint,” it says: “Anyone can read another company’s customer by changing a number in the web address — here’s the file, here’s why it’s a breach with real data, here’s the one-line fix.”

---

How it was built (multi-agent, verified)

This skill isn’t hand-waved from memory. It was generated by an orchestrated 25-subagent audit:

1. Recon (5 agents in parallel) — one agent extracted the real OWASP Top 10 2025 list from the official source docs (not from training data); four dissected the target app’s architecture, authentication/access-control, data/API layer, and secrets/config posture.
2. Map (10 agents) — one agent per OWASP 2025 category cross-referenced the category against the codebase and produced file-grounded review guidance.
3. Verify (10 agents) — a separate adversarial agent re-checked every mapping against the live tree: confirming each referenced file actually exists and each applicability claim holds, dropping anything hallucinated.

All 10 categories came back grounded at high confidence, and the handful of flagged corrections (e.g. exact dependency count, which routes declare which directives) were re-verified by hand before being written down. The result is the references/owasp-2025-crm-map.md you’ll find here.

---

What’s in the box

outskill-owasp-security-review/
├── owasp-security-review/                 ← the skill (this folder goes into ~/.claude/skills/)
│   ├── SKILL.md                           ← the playbook: how to run the review, the 10-category index, report format
│   └── references/
│       └── owasp-2025-crm-map.md          ← the deep map: each OWASP 2025 category → exact files, red flags, fixes, grep commands
├── LICENSE                                ← MIT
└── README.md                              ← you are here

• SKILL.md is what Claude Code loads first. It’s lean: context, the two operating modes, the at-a-glance category table, and the report format.
• references/owasp-2025-crm-map.md is loaded on demand for depth. For each category it gives: a plain-English definition, where the risk lives (specific files), red-flag code patterns, the good pattern (often the repo’s own fixed route), grep commands to surface instances, and a launch-gate verdict.

---

Install

Claude Code discovers skills in ~/.claude/skills/. Drop the owasp-security-review/ folder there.

Option A — clone and copy:

git clone https://github.com/harshith-vaddiparthy/outskill-owasp-security-review.git
cp -R outskill-owasp-security-review/owasp-security-review ~/.claude/skills/

Option B — symlink (so git pull keeps it updated):

git clone https://github.com/harshith-vaddiparthy/outskill-owasp-security-review.git
ln -s "$(pwd)/outskill-owasp-security-review/owasp-security-review" ~/.claude/skills/owasp-security-review

Then restart Claude Code (or start a new session). Confirm it’s picked up:

ls ~/.claude/skills/owasp-security-review

Want it available in every project? ~/.claude/skills/ is global. To scope it to a single repo instead, put the folder in that repo’s .claude/skills/ directory.

---

Use

From a Claude Code session inside the target repo:

/owasp-security-review

The skill runs in one of two modes — it will ask if it’s ambiguous:

Natural-language prompts work too, e.g. “review my CRM for security issues,” “find the launch blockers,” “check tenant isolation and secrets,” or “map my code to the OWASP Top 10.”

Sample output shape

## CRM Security Review — Launch-gate mode
[plain-English summary + the headline risk]

### Findings (worst first)
| # | Plain-English problem | OWASP | Severity | Where (file) | Fix in one line |
| 1 | Anyone can read any company's customers | A01 | Launch blocker | api/vulnerable/contacts | Filter by the logged-in user's org (see api/fixed/contacts) |
...

---

OWASP Top 10 (2025) coverage

Verified against the reference application. “Applies” reflects that specific codebase; on your own app, re-run the review.

New/changed in 2025: A03 Software Supply Chain and A10 Mishandling of Exceptional Conditions are new/expanded; SSRF folded into A01; “Identification and Authentication Failures” renamed to A07 Authentication Failures.

---

Design principles

• Plain language first. State what’s wrong, why it matters with real data, and the smallest fix before any code.
• Cite the fix that already exists. When the codebase ships a correct counterpart (a /fixed/* route, an RLS policy), point at it instead of inventing a new pattern.
• Verify before asserting. The reference doc is a point-in-time audit; the skill is instructed to re-open files and confirm a finding still holds. The code is the source of truth, not this skill.
• Never print secrets — even fake placeholder ones. Name the variable only. Build the habit.
• Defensive only. This is a review-and-explain tool for code you own. It does not write exploit tooling.

---

Adapting it to your own app

The references/owasp-2025-crm-map.md file is tuned to a specific Next.js + Supabase + OpenAI CRM (file names like api/fixed/*, getDemoUser, supabase/rls-*.sql). To retarget it:

1. Keep the category definitions, red flags, good patterns, and grep commands — they’re broadly applicable to any Next.js App Router + Supabase stack.
2. Replace the “Where the risk lives” file references with your own routes and modules.
3. Re-run the review in your repo; let the skill re-confirm what actually applies.

---

Contributing

Issues and PRs welcome — especially:

• Additional red-flag patterns or grep recipes for the Next.js + Supabase stack.
• Generalizing the reference beyond the original lab app.
• Keeping the mapping current as OWASP iterates the Top 10.

---

License

MIT © 2026 Harshith Vaddiparthy.

The OWASP Top 10 is a project of the Open Worldwide Application Security Project and is referenced here for educational use; this repository is not affiliated with or endorsed by OWASP.