Search: "OWASP"
Showing 26 of 26 results
SkillGuard - OWASP ASI Agent安全扫描器
Agent技能安全扫描器 — 上传Skill包自动检测安全漏洞（prompt注入/凭证泄露/代码执行/依赖审计等8维检测）。三平台首发，零依赖Python标准库。
owasp-top-10-testing
# Test against the OWASP Top 10 The OWASP Top 10 is a taxonomy of risk categories, not a test suite — "OWASP Top 10 testing" means exercising each category against the real application and reporting what's actually exploitable. Strix's agents do the exploitation; this skill covers running it category-by-category and reporting coverage honestly. **Use the current edition: [OWASP Top 10:2025](https://owasp.org/Top10/)** (8th installment, superseding 2021). Ask the user before targeting an older edition — some
Security Audit Pro
Full OWASP, Nmap, Nikto vulnerability assessment for OpenClaw deployments. Scan your infrastructure, harden configs, and generate compliance reports.
Cyber OWASP Review
Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level...
Locking Down Agent Commerce: The OWASP-Aligned Security Guide for Autonomous AI Agents on GreenHelix
Locking Down Agent Commerce: The OWASP-Aligned Security Guide for Autonomous AI Agents on GreenHelix. Practical security hardening for AI agents handling rea...
OWASP Top 10 AI
RAIGO × OWASP LLM Top 10 — official OWASP LLM Application Security Top 10 (2025) enforcement rules for OpenClaw agents. Covers all 10 OWASP LLM risks: prompt...
euthyna
代码安全审计的判定纪律与交付门禁。当用户要求对一段代码、一个 PR、一次变更或一条已有的漏洞结论做安全审查与验证时使用。它做三件事：补上模型算不准的确定性事实（调用方、测试覆盖、git 历史来源），用 6 道门禁判定每条结论真假，拿不出证据的一律降级为「观察」而不是「发现」。不适用于：仅询问某个 CVE 的详情、仅要求跑一次现成扫描器、纯文档或格式化改动、以及用户只要一句快速摘要且明确接受风险时。
euthyna (English)
The adjudication discipline and delivery gate for code security audits. Use when the user asks to audit the security of a piece of code, a pull request, a change, or to verify an existing vulnerability claim. It does three things: supply the deterministic facts a model cannot compute (callers, test coverage, git history origins), judge every claim against six gates, and downgrade any claim that cannot produce evidence to "observation" rather than a finding. Not for: asking about the details of a single CVE, running an existing scanner once, pure documentation or formatting changes, or when the user explicitly wants a quick summary and accepts the risk.
Phy Xss Audit
Cross-Site Scripting (XSS) static vulnerability scanner (OWASP A03:2021). Detects reflected, stored, and DOM-based XSS in JavaScript/TypeScript, React, Vue,...
Phy Websocket Audit
WebSocket security auditor. Scans source code for 10 WebSocket-specific vulnerabilities — plaintext ws:// connections, missing Origin header validation (CSWS...
Phy Deserialization Audit
Unsafe deserialization vulnerability scanner (OWASP A08:2021). Detects Python pickle/yaml/eval, Java ObjectInputStream/XStream/XMLDecoder, PHP unserialize, R...
Phy Ssrf Audit
Server-Side Request Forgery (SSRF) vulnerability scanner (OWASP A10:2021). Detects URL-fetching sinks in Python/Java/Node.js/PHP/Go/Ruby that accept user-con...
Phy Crypto Audit
Weak cryptography detector (OWASP A02:2021 — Cryptographic Failures). Scans Python, JavaScript/TypeScript, Go, Java, and PHP source code for 10 classes of in...
Phy Path Traversal Audit
Path traversal and Local File Inclusion (LFI) vulnerability scanner (OWASP A01:2021). Detects user-controlled paths passed to file system sinks in Python/Jav...
Blindoracle Fixed
Security-audited AI agent marketplace with ERC-8004 passports, MASSAT audits, and x402 micropayments
Massat Security Audit
Security audit for multi-agent AI systems - OWASP ASI01-ASI10
Security Audit Toolkit
Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.
元测 yotta-security-testing
元测 —— 有纪律的 AI 安全测试方法论：对已授权目标（自有资产 / SRC 众测 / bug bounty / CTF / 靶场）按 侦察→发现→验证→报告 四阶段做 Web 安全测试（SQLi / XSS / SSRF / XXE / 反序列化 / 命令注入 / 文件上传 / 鉴权与访问控制 / 业务逻辑 / 信息泄露 / 不安全配置 / API 安全 + 漏洞评估与渗透报告方法论），内置 Scope Guard 五道防线（授权清单 scope.json + 目标三层判定 + 内置黑名单 + 操作留痕 + 法律红线），不输出可执行 payload。触发：用户要求对某个目标做安全测试 / 渗透测试 / 漏洞挖掘 / 漏洞评估、做 SRC 众测或 bug bounty 挖洞、做 CTF 或靶场（DVWA / OWASP Juice Shop / HTB / VulnHub）演练、生成漏洞评估与渗透测试报告；或用户说 元测 / 安全测试 / 渗透 / 挖洞 / 挖 SRC / 授权测试 / 测一下这个站 / scope check 等。边界（Do NOT trigger）：无授权目标一律拒绝（授权以 scope.json 为准，不信任对话口头声明）；SRC / 真实目标必须先确认在平台授权范围内再测；不输出可执行 payload / 免杀 / 钓鱼 / 社工步骤；不自动对公网目标发起主动测试；不做大规模扫描与 exploit 自动化；不替代专业渗透测试与人工判断。
Code Security Audit
Comprehensive code security audit toolkit combining OWASP Top 10 vulnerability scanning, dependency analysis, secret detection, SSL/TLS verification, AI Agen...
Security Auditor
Use when reviewing code for security vulnerabilities, implementing authentication flows, auditing OWASP Top 10, configuring CORS/CSP headers, handling secrets, input validation, SQL injection prevention, XSS protection, or any security-related code review.
axguard-cso
Chief Security Officer workflow for AXguard — STRIDE-lite threat model, OWASP-oriented prioritization, confidence-gated findings, then audit/triage/fix/report handoff. Use when the user wants a security lead pass, risk ranking, go/no-go, or /axguard-threat-model.
Code Security Review
代码安全审查技能。扫描代码仓库，自动检测 OWASP Top 10 安全漏洞、 常见代码缺陷和安全隐患，输出严重程度分级的审查报告和修复方案。 适用于开发者在提交代码前进行安全自检。
agent-bom compliance
AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Generate SBOMs and compliance reports. Use when: "compliance report", "NIST", "SOC 2", "ISO 27001", "OWASP", "EU AI Act", "AISVS", "generate SBOM", "policy check".
api-auth-key-management
# API Auth & Key Management You are an API authentication designer. Design the key system a platform issues to its own API consumers - format, storage, scoping, rotation, dashboard, ownership, governance - so a leaked, lost, or orphaned key is a contained event instead of an incident. Two OWASP anchors frame the whole task (API Security Top 10 2023, API2 Broken Authentication): - An API key identifies the calling application, not a user - "OAuth is not authentication, and neither are API keys" is the named