スキル owasp-top-10-testing
📦
owasp-top-10-testing
コンテンツリビジョン r1 中リスク ⚙️ 外部コマンド🌐 ネットワークアクセス
Assess Applications Against the OWASP Top 10
Security assessments can miss categories or confuse incomplete coverage with a clean result. This skill guides Strix testing and evidence-based reporting against OWASP Top 10:2025.
対応: Claude Codex Code(CC)
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "owasp-top-10-testing" from https://skillstore.io/skills/usestrix-owasp-top-10-testing.md and its manifest at https://skillstore.io/api/skills/usestrix-owasp-top-10-testing/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「owasp-top-10-testing」を使用しています。 Summarize OWASP coverage when only one standard account is available.
期待される結果:
- A01: Cross-account and privileged authorization checks remain incomplete because comparison accounts are unavailable.
- A09: External testing cannot assess the logging and alerting pipeline.
- Next steps: Obtain approved comparison accounts and arrange a separate logging pipeline review.
「owasp-top-10-testing」を使用しています。 The scan exited with zero after reaching its budget limit. Can I report that the application passed?
期待される結果:
- No vulnerabilities were proven within the analyzed scope.
- The budget limit prevented a complete assessment; a zero exit code does not establish full OWASP coverage.
- Review run status and cost, document unfinished categories, and schedule further testing.
セキュリティ監査
中リスクv1 • 2026/10/22 バージョン別レポートを開く
All ten static findings are false positives: Markdown backticks, documentation links, and example target URLs do not establish unsafe execution or exfiltration. A separate medium-severity concern is the example placing account passwords in command-line arguments, potentially exposing credentials through process listings or shell history. No evidence found of prompt injection or malicious data exfiltration.
1
スキャンされたファイル
65
解析済み行数
0
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (1)
中
Account Passwords Passed in Command-Line Arguments
The --instruction example embeds user and administrator passwords as account/password pairs. Replacing placeholders with real credentials can expose them through process listings or shell history.
The example explicitly places password placeholders inside a quoted CLI argument. Exposure depends on local process visibility and shell history settings.
リスク要因
⚙️ 外部コマンド (6)
🌐 ネットワークアクセス (4)
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/usestrix-owasp-top-10-testing?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/usestrix-owasp-top-10-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/usestrix-owasp-top-10-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/usestrix-owasp-top-10-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
usestrix. (2026). owasp-top-10-testing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1BibTeX形式の引用
@techreport{usestrix-usestrix-owasp-top-10-testing-2026,
author = {usestrix},
title = {owasp-top-10-testing security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "owasp-top-10-testing security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "usestrix"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1"
identifiers:
- type: other
value: "skillstore:usestrix-owasp-top-10-testing:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠
作成できるもの
Plan an Authorized Assessment
Prepare an OWASP Top 10:2025 assessment with application targets, account roles, exclusions, and realistic coverage expectations.
Validate Security Fixes
Use verified findings and repeated exploit checks to confirm that application changes close previously demonstrated vulnerabilities.
Review Assessment Evidence
Organize results by OWASP category while distinguishing proven findings, unassessed controls, and budget-related gaps.
これらのプロンプトを試す
Understand Assessment Coverage
Explain which OWASP Top 10:2025 categories this skill can assess and which require additional review. Do not run any tests.
Prepare a Scoped Scan
Prepare a Strix assessment plan for [authorized staging target] and [source repository]. Include account roles, exclusions, and budget. Request approval before execution.
Review Assessment Results
Review my Strix run artifacts. Group verified findings by OWASP Top 10:2025 category. Identify coverage gaps and check completion against status and budget.
Plan a Targeted Retest
Using [prior verified findings] and [approved scope], plan a targeted Strix retest. Specify required accounts and evidence needed to confirm each fix.
ベストプラクティス
- Confirm written authorization, approved targets, exclusions, and acceptable testing impact before running exploit-based scans.
- Use disposable test accounts across required roles and tenants; avoid placing real passwords directly in command-line arguments.
- Verify each proof of concept and record the OWASP edition, run completion status, budget constraints, and unassessed categories.
回避
- Treating a zero exit code or budget-capped run as proof that all OWASP categories passed.
- Claiming complete authorization coverage without comparison accounts or marking external logging checks as passed.
- Running active exploitation against production or third-party systems without explicit authorization and agreed scope.
よくある質問
Which OWASP edition does this skill use?
It defaults to OWASP Top 10:2025. The instructions require asking the user before targeting an older edition.
Does it cover API security?
It references OWASP API Security Top 10:2023 and directs API assessments to the separate api-security-testing skill.
Does the skill install Strix?
No installation procedure is included. It directs setup and LLM configuration to penetration-testing-with-strix and references a managed-cloud alternative.
Can it prove compliance across all ten categories?
No. It documents partial coverage and untestable areas. Runtime findings alone do not establish compliance or complete security coverage.
Which accounts are needed for access control testing?
The guidance calls for two accounts across users or tenants plus a privileged account. Missing comparison accounts leave authorization coverage incomplete.
What does a zero exit code mean?
It means no exploitable issue was proven in the analyzed scope. Check run status and budget before describing the assessment as complete.