Навыки owasp-top-10-testing

📦

owasp-top-10-testing

Name: owasp-top-10-testing
Author: usestrix

Ревизия содержимого r1 Средний риск ⚙️ Внешние команды🌐 Доступ к сети

Assess Applications Against the OWASP Top 10

Security assessments can miss categories or confuse incomplete coverage with a clean result. This skill guides Strix testing and evidence-based reporting against OWASP Top 10:2025.

Поддерживает: Claude Codex Code(CC)

📊 70 Адекватно

Maintain this Skill? Claim it 📊 70 Адекватно

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "owasp-top-10-testing" from https://skillstore.io/skills/usestrix-owasp-top-10-testing.md and its manifest at https://skillstore.io/api/skills/usestrix-owasp-top-10-testing/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/usestrix-owasp-top-10-testing.md Подписанный manifest GET /api/skills/usestrix-owasp-top-10-testing/manifest Подписанный lockfile GET /api/skills/usestrix-owasp-top-10-testing/lockfile

Протестировать

Использование «owasp-top-10-testing». Summarize OWASP coverage when only one standard account is available.

Ожидаемый результат:

A01: Cross-account and privileged authorization checks remain incomplete because comparison accounts are unavailable.
A09: External testing cannot assess the logging and alerting pipeline.
Next steps: Obtain approved comparison accounts and arrange a separate logging pipeline review.

Использование «owasp-top-10-testing». The scan exited with zero after reaching its budget limit. Can I report that the application passed?

Ожидаемый результат:

No vulnerabilities were proven within the analyzed scope.
The budget limit prevented a complete assessment; a zero exit code does not establish full OWASP coverage.
Review run status and cost, document unfinished categories, and schedule further testing.

Аудит безопасности

Средний риск

v1 • 22.10.2026 Открыть версионный отчет

All ten static findings are false positives: Markdown backticks, documentation links, and example target URLs do not establish unsafe execution or exfiltration. A separate medium-severity concern is the example placing account passwords in command-line arguments, potentially exposing credentials through process listings or shell history. No evidence found of prompt injection or malicious data exfiltration.

Просканировано файлов

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Средний

SKILL.md:46-47

Account Passwords Passed in Command-Line Arguments

The --instruction example embeds user and administrator passwords as account/password pairs. Replacing placeholders with real credentials can expose them through process listings or shell history.

The example explicitly places password placeholders inside a quoted CLI argument. Exposure depends on local process visibility and shell history settings.

Факторы риска

⚙️ Внешние команды (6)

SKILL.md:16 SKILL.md:41-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58 SKILL.md:60

🌐 Доступ к сети (4)

SKILL.md:7 SKILL.md:14 SKILL.md:43 SKILL.md:44

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/usestrix-owasp-top-10-testing/security.svg)](https://skillstore.io/skills/usestrix-owasp-top-10-testing?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/usestrix-owasp-top-10-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/usestrix-owasp-top-10-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/usestrix-owasp-top-10-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

usestrix. (2026). owasp-top-10-testing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1

Цитата BibTeX

@techreport{usestrix-usestrix-owasp-top-10-testing-2026,
  author = {usestrix},
  title = {owasp-top-10-testing security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "owasp-top-10-testing security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "usestrix"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1"
identifiers:
  - type: other
    value: "skillstore:usestrix-owasp-top-10-testing:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Plan an Authorized Assessment

Prepare an OWASP Top 10:2025 assessment with application targets, account roles, exclusions, and realistic coverage expectations.

Validate Security Fixes

Use verified findings and repeated exploit checks to confirm that application changes close previously demonstrated vulnerabilities.

Review Assessment Evidence

Organize results by OWASP category while distinguishing proven findings, unassessed controls, and budget-related gaps.

Попробуйте эти промпты

Understand Assessment Coverage

Explain which OWASP Top 10:2025 categories this skill can assess and which require additional review. Do not run any tests.

Prepare a Scoped Scan

Prepare a Strix assessment plan for [authorized staging target] and [source repository]. Include account roles, exclusions, and budget. Request approval before execution.

Review Assessment Results

Review my Strix run artifacts. Group verified findings by OWASP Top 10:2025 category. Identify coverage gaps and check completion against status and budget.

Plan a Targeted Retest

Using [prior verified findings] and [approved scope], plan a targeted Strix retest. Specify required accounts and evidence needed to confirm each fix.

Лучшие практики

Confirm written authorization, approved targets, exclusions, and acceptable testing impact before running exploit-based scans.
Use disposable test accounts across required roles and tenants; avoid placing real passwords directly in command-line arguments.
Verify each proof of concept and record the OWASP edition, run completion status, budget constraints, and unassessed categories.

Избегать

Treating a zero exit code or budget-capped run as proof that all OWASP categories passed.
Claiming complete authorization coverage without comparison accounts or marking external logging checks as passed.
Running active exploitation against production or third-party systems without explicit authorization and agreed scope.

Часто задаваемые вопросы

Which OWASP edition does this skill use?

It defaults to OWASP Top 10:2025. The instructions require asking the user before targeting an older edition.

Does it cover API security?

It references OWASP API Security Top 10:2023 and directs API assessments to the separate api-security-testing skill.

Does the skill install Strix?

No installation procedure is included. It directs setup and LLM configuration to penetration-testing-with-strix and references a managed-cloud alternative.

Can it prove compliance across all ten categories?

No. It documents partial coverage and untestable areas. Runtime findings alone do not establish compliance or complete security coverage.

Which accounts are needed for access control testing?

The guidance calls for two accounts across users or tenants plus a privileged account. Missing comparison accounts leave authorization coverage incomplete.

What does a zero exit code mean?

It means no exploitable issue was proven in the analyzed scope. Check run status and budget before describing the assessment as complete.

Сведения для разработчиков

Автор

usestrix

Лицензия

Apache-2.0

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/usestrix/strix/tree/0f81f40765f0329006a9a7d2eb97513f56743a9b/skills/owasp-top-10-testing

Ссылка

31e25b0239ad08e6923e6d38e55743b145da096e

Актуальность поддержки

22.10.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📄 SKILL.md