Cybersecurity Skills

---
name: owasp-audit
description: "Audit application source code against the OWASP Top 10:2025 categories — broken access control (incl. SSRF), security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software and data integrity, logging and alerting failures, mishandling of exceptional conditions — with recon, a coverage ledger, per-finding verification, and a findings.json report. Use when the user mentions 'OWASP,' 'OWASP Top 10,' 'security audit,' 'security review,' 'secure code review,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'appsec review,' 'application security audit,' 'check for security issues,' 'review this PR for security,' 'pre-merge security check,' 'diff review,' 'broken access control,' 'IDOR,' 'SQL injection,' 'XSS,' 'SSRF,' 'webhook security,' or wants to check their codebase for common security weaknesses."
allowed-tools: Read, Grep, Glob, Bash(npm audit), Bash(npm audit --omit=dev)
---

# OWASP Audit — Source Code Security Review

Perform a systematic security audit of application source code against the OWASP Top 10:2025. Every candidate is
traced, then independently challenged, before it becomes a finding. Coverage is recorded per surface and trust
boundary, so "clean" means someone actually read the code.

Cross-references:
- `api-audit` for a surface-driven pass over every API endpoint (shares the recon, verification, and orchestration references)
- `web-pentest` "Combined white-box + black-box mode" when you have both the source and a running instance you're authorized to test
- `business-logic-testing` to prove race conditions and logic flaws dynamically (A06)
- `dependency-audit` for the full A03 supply-chain picture; `secrets-audit` for leaked credentials
- `threat-modeling` for the principal / trust-boundary vocabulary used in recon
- `finding-triage` to take a single finding from this report to a defensible disposition

## Authorization and Mode

Only audit code the user owns or is authorized to review. Any live check (for example `curl -I` against a deployed
origin) needs the same authorization for that host and stays non-destructive.

Pick the mode before starting:

- **Guidance** (default): a question, a single file, or "how do I secure X". Answer directly. Findings still follow the
  verdict rules below. No ledger required.
- **Full audit**: the user explicitly asks to audit or security-review a codebase, a release, or a PR. Run the full
  workflow below.
- **Diff / PR-scoped**: the user wants a branch, PR, or commit range reviewed, or a pre-merge gate. Run the full workflow
  limited to the change, using [references/diff-review.md](references/diff-review.md).

If it's ambiguous, ask one question: guidance pass or full audit (and which profile)?

## Workflow (full audit)

1. **Scope**: what's in, what's out, mode, and run profile
2. **Recon**: write `architecture.md` and `coverage.json` before hunting