技能 owasp-top-10-testing
📦

owasp-top-10-testing

內容修訂 r1 中風險 ⚙️ 外部命令🌐 網路存取

Assess Applications Against the OWASP Top 10

Security assessments can miss categories or confuse incomplete coverage with a clean result. This skill guides Strix testing and evidence-based reporting against OWASP Top 10:2025.

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it 📊 70 尚可

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "owasp-top-10-testing" from https://skillstore.io/skills/usestrix-owasp-top-10-testing.md and its manifest at https://skillstore.io/api/skills/usestrix-owasp-top-10-testing/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/usestrix-owasp-top-10-testing.md 已簽名 manifest GET /api/skills/usestrix-owasp-top-10-testing/manifest 已簽名 lockfile GET /api/skills/usestrix-owasp-top-10-testing/lockfile

測試它

正在使用「owasp-top-10-testing」。 Summarize OWASP coverage when only one standard account is available.

預期結果:

  • A01: Cross-account and privileged authorization checks remain incomplete because comparison accounts are unavailable.
  • A09: External testing cannot assess the logging and alerting pipeline.
  • Next steps: Obtain approved comparison accounts and arrange a separate logging pipeline review.

正在使用「owasp-top-10-testing」。 The scan exited with zero after reaching its budget limit. Can I report that the application passed?

預期結果:

  • No vulnerabilities were proven within the analyzed scope.
  • The budget limit prevented a complete assessment; a zero exit code does not establish full OWASP coverage.
  • Review run status and cost, document unfinished categories, and schedule further testing.

安全審計

中風險
v1 • 2026/10/22 開啟版本化報告

All ten static findings are false positives: Markdown backticks, documentation links, and example target URLs do not establish unsafe execution or exfiltration. A separate medium-severity concern is the example placing account passwords in command-line arguments, potentially exposing credentials through process listings or shell history. No evidence found of prompt injection or malicious data exfiltration.

1
已掃描檔案
65
分析行數
0
複核項目
0
已忽略的誤報

已確認的安全問題 (1)

中
SKILL.md:46-47
Account Passwords Passed in Command-Line Arguments
The --instruction example embeds user and administrator passwords as account/password pairs. Replacing placeholders with real credentials can expose them through process listings or shell history.
The example explicitly places password placeholders inside a quoted CLI argument. Exposure depends on local process visibility and shell history settings.

風險因素

⚙️ 外部命令 (6)
SKILL.md:16 SKILL.md:41-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58 SKILL.md:60
🌐 網路存取 (4)
SKILL.md:7 SKILL.md:14 SKILL.md:43 SKILL.md:44
審計單位: codex
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/usestrix-owasp-top-10-testing/security.svg)](https://skillstore.io/skills/usestrix-owasp-top-10-testing?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/usestrix-owasp-top-10-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/usestrix-owasp-top-10-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/usestrix-owasp-top-10-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

usestrix. (2026). owasp-top-10-testing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1

BibTeX 引用

@techreport{usestrix-usestrix-owasp-top-10-testing-2026, author = {usestrix}, title = {owasp-top-10-testing security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "owasp-top-10-testing security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "usestrix" date-released: "2026-10-22" url: "https://skillstore.io/skills/usestrix-owasp-top-10-testing/audits/1" identifiers: - type: other value: "skillstore:usestrix-owasp-top-10-testing:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
55
架構
85
可維護性
87
內容
65
社群
91
規範符合度

你可以打造什麼

Plan an Authorized Assessment

Prepare an OWASP Top 10:2025 assessment with application targets, account roles, exclusions, and realistic coverage expectations.

Validate Security Fixes

Use verified findings and repeated exploit checks to confirm that application changes close previously demonstrated vulnerabilities.

Review Assessment Evidence

Organize results by OWASP category while distinguishing proven findings, unassessed controls, and budget-related gaps.

試試這些提示

Understand Assessment Coverage 
Explain which OWASP Top 10:2025 categories this skill can assess and which require additional review. Do not run any tests.
Prepare a Scoped Scan 
Prepare a Strix assessment plan for [authorized staging target] and [source repository]. Include account roles, exclusions, and budget. Request approval before execution.
Review Assessment Results 
Review my Strix run artifacts. Group verified findings by OWASP Top 10:2025 category. Identify coverage gaps and check completion against status and budget.
Plan a Targeted Retest 
Using [prior verified findings] and [approved scope], plan a targeted Strix retest. Specify required accounts and evidence needed to confirm each fix.

最佳實務

  • Confirm written authorization, approved targets, exclusions, and acceptable testing impact before running exploit-based scans.
  • Use disposable test accounts across required roles and tenants; avoid placing real passwords directly in command-line arguments.
  • Verify each proof of concept and record the OWASP edition, run completion status, budget constraints, and unassessed categories.

避免

  • Treating a zero exit code or budget-capped run as proof that all OWASP categories passed.
  • Claiming complete authorization coverage without comparison accounts or marking external logging checks as passed.
  • Running active exploitation against production or third-party systems without explicit authorization and agreed scope.

常見問題

Which OWASP edition does this skill use?
It defaults to OWASP Top 10:2025. The instructions require asking the user before targeting an older edition.
Does it cover API security?
It references OWASP API Security Top 10:2023 and directs API assessments to the separate api-security-testing skill.
Does the skill install Strix?
No installation procedure is included. It directs setup and LLM configuration to penetration-testing-with-strix and references a managed-cloud alternative.
Can it prove compliance across all ten categories?
No. It documents partial coverage and untestable areas. Runtime findings alone do not establish compliance or complete security coverage.
Which accounts are needed for access control testing?
The guidance calls for two accounts across users or tenants plus a privileged account. Missing comparison accounts leave authorization coverage incomplete.
What does a zero exit code mean?
It means no exploitable issue was proven in the analyzed scope. Check run status and budget before describing the assessment as complete.

開發者詳細資訊

作者

usestrix

授權

Apache-2.0

Skillstore 修訂

r1

版本提示

作者未聲明版本。

儲存庫

https://github.com/usestrix/strix/tree/0f81f40765f0329006a9a7d2eb97513f56743a9b/skills/owasp-top-10-testing

引用

31e25b0239ad08e6923e6d38e55743b145da096e

維護新鮮度

2026/10/22

使用量

0 次下載 · 0 次瀏覽

檔案結構

📄 SKILL.md

usestrix 的更多技能

查看全部

相關技能

查看全部