OWASP Security Review — a Claude Code Skill

A plug-in Claude Code skill that runs a launch-gate security review against the OWASP Top 10 (2025) on a Next.js + Supabase + OpenAI codebase — and explains every finding in plain language, so a non-coder can act on it.

It was purpose-built for the Vibe CRM Security Lab (a deliberately-vulnerable teaching CRM), but the methodology and the per-category checklist work as a general OWASP-2025 review for any modern Next.js App Router + Supabase app.

TL;DR — Type /owasp-security-review in Claude Code. It maps all 10 OWASP 2025 risks to the exact files in your repo, rates severity, and points at the concrete fix — no security jargon required.

---

Why this exists

Most “AI security review” is generic: it lists the OWASP Top 10 and hand-waves. This skill is the opposite — it is grounded in one real codebase. Every finding names a real file, a real line of reasoning, and (where the lab provides one) the correct version already sitting next to the broken one.

It’s written for an owner who prompts but doesn’t read code. So instead of “IDOR on the contact endpoint,” it says: “Anyone can read another company’s customer by changing a number in the web address — here’s the file, here’s why it’s a breach with real data, here’s the one-line fix.”

---

How it was built (multi-agent, verified)

This skill isn’t hand-waved from memory. It was generated by an orchestrated 25-subagent audit:

1. Recon (5 agents in parallel) — one agent extracted the real OWASP Top 10 2025 list from the official source docs (not from training data); four dissected the target app’s architecture, authentication/access-control, data/API layer, and secrets/config posture.
2. Map (10 agents) — one agent per OWASP 2025 category cross-referenced the category against the codebase and produced file-grounded review guidance.
3. Verify (10 agents) — a separate adversarial agent re-checked every mapping against the live tree: confirming each referenced file actually exists and each applicability claim holds, dropping anything hallucinated.

All 10 categories came back grounded at high confidence, and the handful of flagged corrections (e.g. exact dependency count, which routes declare which directives) were re-verified by hand before being written down. The result is the references/owasp-2025-crm-map.md you’ll find here.

---

What’s in the box

outskill-owasp-security-review/
├── owasp-security-review/                 ← the skill (this folder goes into ~/.claude/skills/)
│   ├── SKILL.md                           ← the playbook: how to run the review, the 10-category index, report format
│   └── references/
│       └── owasp-2025-crm-map.md          ← the deep map: each OWASP 2025 category → exact files, red flags, fixes, grep commands