[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CQVCW1AKT1HT5XAY0RYH91":3,"skill-same:01M6CQVCW1AKT1HT5XAY0RYH91":69},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":53,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6CQVCW1AKT1HT5XAY0RYH91","owasp-top10-review",null,"Category-by-category OWASP Top 10:2025 coverage assessment of a codebase: maps existing SEC-XXX findings onto the taxonomy, probes the categories bottom-up reviews miss (supply chain, exceptional conditions, logging, SSRF) and re-ranks priorities. Use when asked 'are we OWASP-compliant' or 'how do we score against the Top 10', before an audit or a security questionnaire, or after security reviews accumulate. Not for one delivered ticket (security-review) or the model surface of an LLM application (owasp-llm-top10-review).","gener8v\u002Fgener8v.claude-skills","gener8v","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F262388633?v=4","01M6CQT9VAG2MX3NN1CBMGR2T8","GENER8V","01M6CQT9YZXXYFF41ZYFW774DQ",3,"MIT","https:\u002F\u002Fgithub.com\u002Fgener8v\u002Fgener8v.claude-skills\u002Fblob\u002Fmain\u002Fskills\u002Fowasp-top10-review\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"owasp top10 review","owasp","review","system","priorities","supply chain","do","maps","up","use","coverage","model","how","taxonomy","security-review","owasp-llm","owasp-llm-top10","audit","assessment","owasp top 10","2026-11-10 10:12:30",false,"---\nname: owasp-top10-review\ndescription: \"Category-by-category OWASP Top 10:2025 coverage assessment of a codebase: maps existing SEC-XXX findings onto the taxonomy, probes the categories bottom-up reviews miss (supply chain, exceptional conditions, logging, SSRF) and re-ranks priorities. Use when asked 'are we OWASP-compliant' or 'how do we score against the Top 10', before an audit or a security questionnaire, or after security reviews accumulate. Not for one delivered ticket (security-review) or the model surface of an LLM application (owasp-llm-top10-review).\"\nargument-hint: \"[system slug]\"\ncontext: fork\neffort: xhigh\n---\n\n# OWASP Top 10 Review Skill\n\n## Purpose\n\nPerform a systematic, category-by-category assessment of a codebase against the **OWASP Top 10:2025** web application security risks. Where the Security Review skill hunts for individual vulnerabilities bottom-up, this skill works top-down: it walks all ten OWASP categories, assesses the system's posture in each, maps existing findings (SEC-XXX) onto the framework, verifies the categories a finding-by-finding pass tends to under-probe, and produces a coverage matrix that makes gaps and strengths legible against an industry-standard taxonomy.\n\nIt is the framework-coverage complement to Security Review: Security Review finds the bugs; this skill proves coverage and surfaces whole categories that were missed.\n\n## When to Use\n\nUse this skill when:\n- A stakeholder asks \"are we OWASP-compliant?\" or \"how do we score against the Top 10?\"\n- After a Security Review, to organize findings against a recognized taxonomy and check for blind spots\n- Before an audit, certification, or customer security questionnaire\n- When prior security reviews or assessments exist and need re-ranking against the current OWASP edition (the 2025 list reshuffled and renamed several categories)\n- For periodic posture reviews where category completeness matters more than finding novelty\n\n## Input\n\n**Source:** Delivered code, configuration, infrastructure-as-code, CI\u002FCD, and any existing security review reports\n**Read from:**\n- The codebase (application routes, auth, data layer, config, containers, compose\u002FIaC, CI workflows)\n- Every existing security review report — `.gener8v\u002Fchanges\u002F*\u002Freviews\u002F*-security-review.md` (one per delivered ticket, under the change it belongs to; a legacy project may still hold them at `.gener8v\u002Freviews\u002F*-security-review.md`) — to map their SEC-XXX findings onto categories rather than re-deriving them. Numbering restarts per report, so findings are referenced with the change segment, `\u003Cchange-slug>\u002F\u003Creport-slug>\u002FSEC-XXX` — e.g. `support-search\u002Fsearch-and-retrieval-ticket-002-security-review\u002FSEC-002` (`CONVENTIONS.md` §4)\n- Constraints: `.gener8v\u002Fconstraints\u002F[slug].md` (if available — for compliance requirements)\n- Technical Design \u002F System Context (if available — for deployment topology)\n\n**Expects:** Code to exist. Degrades gracefully — with no prior security review it derives findings directly; with one, it maps and supplements.\n\n## Output\n\n**Produces:** An OWASP Top 10:2025 coverage assessment\n**Write to:** `.gener8v\u002Freviews\u002F[slug]-owasp-top10-assessment.md`\n**Creates directory:** `.gener8v\u002Freviews\u002F` if absent\n**Naming:** `-owasp-top10-assessment` suffix\n\nNew findings discovered during the pass are numbered `SEC-001…` **within this assessment** and described in full here; other documents reference them as `\u003Csystem-slug>-owasp-top10-assessment\u002FSEC-XXX`. Per-ticket security reviews are point-in-time reports and are never edited by this skill. There is no shared register to maintain: Orchestrate lists every review and assessment, and the qualified ID is what makes a reference unambiguous.\n\n## The Framework — OWASP Top 10:2025\n\nAssess every category. The 2025 edition (finalized January 2026) reshuffled and added categories — use these, not the 2021 list:\n\n- **A01:2025 — Broken Access Control** (authn, authz, IDOR, tenant isolation, function\u002Fobject-level checks)\n- **A02:2025 — Security Misconfiguration** (↑ from #5: env gating, exposed surfaces, CORS, headers, container hardening, IaC, default secrets)\n- **A03:2025 — Software Supply Chain Failures** (NEW, broadens \"Vulnerable & Outdated Components\": dependencies + build systems + distribution + CI\u002FCD integrity)\n- **A04:2025 — Cryptographic Failures** (hashing, token signing, data-at-rest\u002Fin-transit, key management)\n- **A05:2025 — Injection** (SQL\u002FNoSQL\u002Fcommand\u002Ftemplate\u002FLDAP, XSS, insecure deserialization)\n- **A06:2025 — Insecure Design** (design-level flaws, missing controls by design, abuse cases, mass assignment, resource limits)\n- **A07:2025 — Authentication Failures** (credential strength, brute-force protection, session\u002Ftoken lifecycle, enumeration)\n- **A08:2025 — Data Integrity Failures** (deserialization integrity, update integrity, CI\u002FCD pipeline integrity not covered by A03)\n- **A09:2025 — Security Logging & Alerting Failures** (logging of auth\u002Fauthz events, monitoring coverage, alerting)\n- **A10:2025 — Mishandling of Exceptional Conditions** (NEW, 24 CWEs: fail-open behavior, improper error handling, failing into insecure state)\n\nNote: SSRF is no longer a standalone top-level category in 2025 (folded in) — still assess it as a sub-check under A10\u002FA05.\n\n## Output Format\n\n```markdown\n# [System]: OWASP Top 10:2025 Assessment\n\n## 1. Coverage Summary\n[Table: # | Category | Status (Adequate \u002F Gaps \u002F Primary gap \u002F Not applicable) | Driving findings]\n[2-3 sentence net: where risk concentrates, which categories pass.]\n\n## 2. Category-by-Category Assessment\n### A01 — Broken Access Control · [status]\n**What was checked:** ...\n**Evidence (controls present):** ...\n**Gaps \u002F findings:** [mapped SEC-XXX + any new]\n[... repeat for A02–A10 ...]\n\n## 3. New-Category \u002F New-Finding Pass\n[Focused analysis of A03 supply chain and A10 exceptional-conditions, plus any new SEC-XXX raised, fully described: severity, category, location, attack scenario (Med+), impact, recommendation.]\n\n## 4. Finding Totals\n[Counts by severity; table of findings by 2025 category slot.]\n\n## 5. Conclusion\n[Priority guidance re-ranked by 2025 weighting.]\n```\n\n## Principles\n\n### Assess Every Category — Including \"Not Applicable\"\nA category with no findings is a result, not a skip. State what was checked and why it does not apply (e.g. \"no vector DB → A10-LLM N\u002FA\"). A blank category reads as \"not assessed,\" which is the opposite of coverage.\n\n### Verify the Under-Probed Categories\nBottom-up bug hunts reliably miss A08 (insecure deserialization), A09 (logging gaps), A10 (fail-open error handling), and the SSRF sub-check. Actively grep for them: `pickle`\u002F`yaml.load`\u002F`marshal` (deserialization); logging calls around auth failures and authz denials (A09); broad\u002F`except Exception` and silent fallbacks (A10); backend fetches of user-controlled URLs (SSRF). Absence of evidence is only evidence of absence after you look.\n\n### Map, Don't Duplicate\nIf per-ticket security reviews exist, map their SEC-XXX (qualified) onto categories rather than re-describing each finding. Add value through coverage and re-ranking, not restatement. Only fully describe findings this pass newly discovers.\n\n### Honor the 2025 Re-Ranking\nThe 2025 edition moved Security Misconfiguration to #2 and introduced Software Supply Chain Failures at #3. When advising priority, reflect the current weighting — a misconfiguration cluster is now a #2-class concern, not a #5-class one.\n\n### Attack Scenarios for Medium+\nEvery Medium-or-higher finding states who the attacker is, what access they have, and what they achieve. A finding without a scenario is an assertion.\n\n### Compliance Constraints Are Non-Negotiable\nA documented compliance constraint (CC-XXX) violation is automatically Critical regardless of exploitability.\n\n## Process\n\n1. **Locate inputs** — read the codebase and every existing security review under `.gener8v\u002Fchanges\u002F*\u002Freviews\u002F` (and the legacy `.gener8v\u002Freviews\u002F*-security-review.md`, if present).\n2. **Inventory the attack surface** — routes\u002Fentry points, auth model, data layer, config, containers, IaC, CI\u002FCD.\n3. **Walk A01→A10** — for each, record what was checked, evidence of controls present, and gaps; map existing SEC-XXX.\n4. **Run the under-probed verifications** — deserialization, security-event logging, fail-open `except` patterns, SSRF, mass assignment. Use targeted greps; cite file:line.\n5. **Deep-pass the 2025 additions** — A03 (deps + base-image pinning + CI integrity + a continuous-scan gate) and A10 (enumerate every degrading\u002Fbroad `except`; classify fail-open vs fail-closed vs intentional-degradation; the security-relevant fail-opens become findings).\n6. **Raise & number new findings** — `SEC-001…` within this assessment; full descriptions; findings that need code changes become tickets via Ticket Breakdown (cite the qualified ID).\n7. **Build the coverage matrix + re-ranked priority** — counts by severity, findings by 2025 category.\n8. **Write the report** to `.gener8v\u002Freviews\u002F`.\n\n## Example (abbreviated)\n\n> **A02 — Security Misconfiguration · Primary Gap.** Placeholder database password in a fallback connection string (`support-search\u002Fsearch-and-retrieval-ticket-002-security-review\u002FSEC-001`), root containers and unpinned base images (new findings SEC-001, SEC-002 in this assessment), CORS wildcard methods\u002Fheaders and missing security headers (SEC-003, SEC-004). Elevated to #2 under the 2025 weighting.\n>\n> **A10 — Mishandling of Exceptional Conditions · Minor.** Reviewed every degrading `except`: a missing `DATABASE_URL` now fails closed (correct, after the ticket-002 fix); the ingestion worker falls back to shared source credentials on a decrypt error (fail-open → new finding SEC-005); indexing-queue degradations are intentional but should alert (ties A09 \u002F `…ticket-002-security-review\u002FSEC-002`).\n\n## Troubleshooting\n\n- **The assessment covered the wrong system, or none of the focus the user asked for.** This skill runs in a forked subagent that sees the skill and its arguments, not the conversation. Put the system slug, and any surface to weight (the public API, the admin console), in the argument. The slug names the report `.gener8v\u002Freviews\u002F\u003Cslug>-owasp-top10-assessment.md`; Orchestrate finds assessments in `.gener8v\u002Freviews\u002F` by their `-assessment.md` suffix, so keep the name exact.\n- **Two different findings are both `SEC-001`.** Numbering restarts per report, and this assessment starts its own. Always cite qualified IDs — `support-search\u002Fsearch-and-retrieval-ticket-002-security-review\u002FSEC-002` for a ticket review, `\u003Cslug>-owasp-top10-assessment\u002FSEC-001` for this one — in the matrix, the priorities and any ticket that fixes a finding.\n- **The A03 deep pass cannot run a dependency or image scan.** Say which scan was not run and why, and rate A03 on what was verified by reading — pinning, lockfiles, CI integrity. Do not mark it clean on the strength of a scan that never happened.\n- **The system also calls a model.** Prompt injection, output handling and denial-of-wallet belong to the OWASP LLM Top 10 Review, run alongside. Do not fold them into A03 or A05 here; note that the model surface is assessed there.\n\n## Integration with Other Skills\n\n**Upstream:** Security Review (provides the per-ticket SEC-XXX findings to map, under `changes\u002F\u003Cchange-slug>\u002Freviews\u002F`); Constraints (compliance); Technical Design (topology).\n**Parallel:** OWASP LLM Top 10 Review (for AI\u002FLLM systems — run both; this covers the web surface, that covers the model surface).\n**Downstream:** Audit (consumes coverage results); Ticket Breakdown (new findings that need code changes become tickets); Orchestrate (lists the assessment under `cross_cutting.assessments`).\n\n## Revisions\n\n- Re-run when a new OWASP edition lands (re-rank the findings), after deliveries that touch authentication, configuration, dependencies or external input, and before an audit or questionnaire.\n- Re-running replaces `[slug]-owasp-top10-assessment.md`; carry forward the previous assessment's open findings with their status so nothing is silently dropped.\n\n## Notes\n\n- Point-in-time. OWASP revises the Top 10 periodically (2021 → 2025); confirm you are assessing against the current edition and re-rank prior assessments when a new edition lands.\n- This skill assesses against a taxonomy — it does not replace deep bug-hunting (Security Review) or threat modeling.\n- For API-heavy systems, add a short **OWASP API Security Top 10 (2023)** cross-map — it resolves object\u002Ffunction-level authz and resource-consumption risks the web list blurs.\n- Can run standalone (derives findings) or as a coverage layer over an existing Security Review (maps + supplements).\n","# OWASP Top 10 Review Skill\n\n## Purpose\n\nPerform a systematic, category-by-category assessment of a codebase against the **OWASP Top 10:2025** web application security risks. Where the Security Review skill hunts for individual vulnerabilities bottom-up, this skill works top-down: it walks all ten OWASP categories, assesses the system's posture in each, maps existing findings (SEC-XXX) onto the framework, verifies the categories a finding-by-finding pass tends to under-probe, and produces a coverage matrix that makes gaps and strengths legible against an industry-standard taxonomy.\n\nIt is the framework-coverage complement to Security Review: Security Review finds the bugs; this skill proves coverage and surfaces whole categories that were missed.\n\n## When to Use\n\nUse this skill when:\n- A stakeholder asks \"are we OWASP-compliant?\" or \"how do we score against the Top 10?\"\n- After a Security Review, to organize findings against a recognized taxonomy and check for blind spots\n- Before an audit, certification, or customer security questionnaire\n- When prior security reviews or assessments exist and need re-ranking against the current OWASP edition (the 2025 list reshuffled and renamed several categories)\n- For periodic posture reviews where category completeness matters more than finding novelty\n\n## Input\n\n**Source:** Delivered code, configuration, infrastructure-as-code, CI\u002FCD, and any existing security review reports\n**Read from:**\n- The codebase (application routes, auth, data layer, config, containers, compose\u002FIaC, CI workflows)\n- Every existing security review report — `.gener8v\u002Fchanges\u002F*\u002Freviews\u002F*-security-review.md` (one per delivered ticket, under the change it belongs to; a legacy project may still hold them at `.gener8v\u002Freviews\u002F*-security-review.md`) — to map their SEC-XXX findings onto categories rather than re-deriving them. Numbering restarts per report, so findings are referenced with the change segment, `\u003Cchange-slug>\u002F\u003Creport-slug>\u002FSEC-XXX` — e.g. `support-search\u002Fsearch-and-retrieval-ticket-002-security-review\u002FSEC-002` (`CONVENTIONS.md` §4)\n- Constraints: `.gener8v\u002Fconstraints\u002F[slug].md` (if available — for compliance requirements)\n- Technical Design \u002F System Context (if available — for deployment topology)\n\n**Expects:** Code to exist. Degrades gracefully — with no prior security review it derives findings directly; with one, it maps and supplements.\n\n## Output\n\n**Produces:** An OWASP Top 10:2025 coverage assessment\n**Write to:** `.gener8v\u002Freviews\u002F[slug]-owasp-top10-assessment.md`\n**Creates directory:** `.gener8v\u002Freviews\u002F` if absent\n**Naming:** `-owasp-top10-assessment` suffix\n\nNew findings discovered during the pass are numbered `SEC-001…` **within this assessment** and described in full here; other documents reference them as `\u003Csystem-slug>-owasp-top10-assessment\u002FSEC-XXX`. Per-ticket security reviews are point-in-time reports and are never edited by this skill. There is no shared register to maintain: Orchestrate lists every review and assessment, and the qualified ID is what makes a reference unambiguous.\n\n## The Framework — OWASP Top 10:2025\n\nAssess every category. The 2025 edition (finalized January 2026) reshuffled and added categories — use these, not the 2021 list:\n\n- **A01:2025 — Broken Access Control** (authn, authz, IDOR, tenant isolation, function\u002Fobject-level checks)\n- **A02:2025 — Security Misconfiguration** (↑ from #5: env gating, exposed surfaces, CORS, headers, container hardening, IaC, default secrets)\n- **A03:2025 — Software Supply Chain Failures** (NEW, broadens \"Vulnerable & Outdated Components\": dependencies + build systems + distribution + CI\u002FCD integrity)\n- **A04:2025 — Cryptographic Failures** (hashing, token signing, data-at-rest\u002Fin-transit, key management)\n- **A05:2025 — Injection** (SQL\u002FNoSQL\u002Fcommand\u002Ftemplate\u002FLDAP, XSS, insecure deserialization)\n- **A06:2025 — Insecure Design** (design-level flaws, missing controls by design, abuse cases, mass assignment, resource limits)\n- **A07:2025 — Authentication Failures** (credential strength, brute-force protection, session\u002Ftoken lifecycle, enumeration)\n- **A08:2025 — Data Integrity Failures** (deserialization integrity, update integrity, CI\u002FCD pipeline integrity not covered by A03)\n- **A09:2025 — Security Logging & Alerting Failures** (logging of auth\u002Fauthz events, monitoring coverage, alerting)\n- **A10:2025 — Mishandling of Exceptional Conditions** (NEW, 24 CWEs: fail-open behavior, improper error handling, failing into insecure state)\n\nNote: SSRF is no longer a standalone top-level category in 2025 (folded in) — still assess it as a sub-check under A10\u002FA05.\n\n## Output Format\n\n```markdown\n# [System]: OWASP Top 10:2025 Assessment\n\n## 1. Coverage Summary\n[Table: # | Category | Status (Adequate \u002F Gaps \u002F Primary gap \u002F Not applicable) | Driving findings]\n[2-3 sentence net: where risk concentrates, which categories pass.]\n\n## 2. Category-by-Category Assessment\n### A01 — Broken Access Control · [status]\n**What was checked:** ...\n**Evidence (controls present):** ...\n**Gaps \u002F findings:** [mapped SEC-XXX + any new]\n[... repeat for A02–A10 ...]\n\n## 3. New-Category \u002F New-Finding Pass\n[Focused analysis of A03 supply chain and A10 exceptional-conditions, plus any new SEC-XXX raised, fully described: severity, category, location, attack scenario (Med+), impact, recommendation.]\n\n## 4. Finding Totals\n[Counts by severity; table of findings by 2025 category slot.]\n\n## 5. Conclusion\n[Priority guidance re-ranked by 2025 weighting.]\n```\n\n## Principles\n\n### Assess Every Category — Including \"Not Applicable\"\nA category with no findings is a result, not a skip. State what was checked and why it does not apply (e.g. \"no vector DB → A10-LLM N\u002FA\"). A blank category reads as \"not assessed,\" which is the opposite of coverage.\n\n### Verify the Under-Probed Categories\nBottom-up bug hunts reliably miss A08 (insecure deserialization), A09 (logging gaps), A10 (fail-open error handling), and the SSRF sub-check. Actively grep for them: `pickle`\u002F`yaml.load`\u002F`marshal` (deserialization); logging calls around auth failures and authz denials (A09); broad\u002F`except Exception` and silent fallbacks (A10); backend fetches of user-controlled URLs (SSRF). Absence of evidence is only evidence of absence after you look.\n\n### Map, Don't Duplicate\nIf per-ticket security reviews exist, map their SEC-XXX (qualified) onto categories rather than re-describing each finding. Add value through coverage and re-ranking, not restatement. Only fully describe findings this pass newly discovers.\n\n### Honor the 2025 Re-Ranking\nThe 2025 edition moved Security Misconfiguration to #2 and introduced Software Supply Chain Failures at #3. When advising priority, reflect the current weighting — a misconfiguration cluster is now a #2-class concern, not a #5-class one.\n\n### Attack Scenarios for Medium+\nEvery Medium-or-higher finding states who the attacker is, what access they have, and what they achieve. A finding without a scenario is an assertion.\n\n### Compliance Constraints Are Non-Negotiable\nA documented compliance constraint (CC-XXX) violation is automatically Critical regardless of exploitability.\n\n## Process\n\n1. **Locate inputs** — read the codebase and every existing security review under `.gener8v\u002Fchanges\u002F*\u002Freviews\u002F` (and the legacy `.gener8v\u002Freviews\u002F*-security-review.md`, if present).\n2. **Inventory the attack surface** — routes\u002Fentry points, auth model, data layer, config, containers, IaC, CI\u002FCD.\n3. **Walk A01→A10** — for each, record what was checked, evidence of controls present, and gaps; map existing SEC-XXX.\n4. **Run the under-probed verifications** — deserialization, security-event logging, fail-open `except` patterns, SSRF, mass assignment. Use targeted greps; cite file:line.\n5. **Deep-pass the 2025 additions** — A03 (deps + base-image pinning + CI integrity + a continuous-scan gate) and A10 (enumerate every degrading\u002Fbroad `except`; classify fail-open vs fail-closed vs intentional-degradation; the security-relevant fail-opens become findings).\n6. **Raise & number new findings** — `SEC-001…` within this assessment; full descriptions; findings that need code changes become tickets via Ticket Breakdown (cite the qualified ID).\n7. **Build the coverage matrix + re-ranked priority** — counts by severity, findings by 2025 category.\n8. **Write the report** to `.gener8v\u002Freviews\u002F`.\n\n## Example (abbreviated)\n\n> **A02 — Security Misconfiguration · Primary Gap.** Placeholder database password in a fallback connection string (`support-search\u002Fsearch-and-retrieval-ticket-002-security-review\u002FSEC-001`), root containers and unpinned base images (new findings SEC-001, SEC-002 in this assessment), CORS wildcard methods\u002Fheaders and missing security headers (SEC-003, SEC-004). Elevated to #2 under the 2025 weighting.\n>\n> **A10 — Mishandling of Exceptional Conditions · Minor.** Reviewed every degrading `except`: a missing `DATABASE_URL` now fails closed (correct, after the ticket-002 fix); the ingestion worker falls back to shared source credentials on a decrypt error (fail-open → new finding SEC-005); indexing-queue degradations are intentional but should alert (ties A09 \u002F `…ticket-002-security-review\u002FSEC-002`).\n\n## Troubleshooting\n\n- **The assessment covered the wrong system, or none of the focus the user asked for.** This skill runs in a forked subagent that sees the skill and its arguments, not the conversation. Put the system slug, and any surface to weight (the public API, the admin console), in the argument. The slug names the report `.gener8v\u002Freviews\u002F\u003Cslug>-owasp-top10-assessment.md`; Orchestrate finds assessments in `.gener8v\u002Freviews\u002F` by their `-assessment.md` suffix, so keep the name exact.\n- **Two different findings are both `SEC-001`.** Numbering restarts per report, and this assessment starts its own. Always cite qualified IDs — `support-search\u002Fsearch-and-retrieval-ticket-002-security-review\u002FSEC-002` for a ticket review, `\u003Cslug>-owasp-top10-assessment\u002FSEC-001` for this one — in the matrix, the priorities and any ticket that fixes a finding.\n- **The A03 deep pass cannot run a dependency or image scan.** Say which scan was not run and why, and rate A03 on what was verified by reading — pinning, lockfiles, CI integrity. Do not mark it clean on the strength of a scan that never happened.\n- **The system also calls a model.** Prompt injection, output handling and denial-of-wallet belong to the OWASP LLM Top 10 Review, run alongside. Do not fold them into A03 or A05 here; note that the model surface is assessed there.\n\n## Integration with Other Skills\n\n**Upstream:** Security Review (provides the per-ticket SEC-XXX findings to map, under `changes\u002F\u003Cchange-slug>\u002Freviews\u002F`); Constraints (compliance); Technical Design (topology).\n**Parallel:** OWASP LLM Top 10 Review (for AI\u002FLLM systems — run both; this covers the web surface, that covers the model surface).\n**Downstream:** Audit (consumes coverage results); Ticket Breakdown (new findings that need code changes become tickets); Orchestrate (lists the assessment under `cross_cutting.assessments`).\n\n## Revisions\n\n- Re-run when a new OWASP edition lands (re-rank the findings), after deliveries that touch authentication, configuration, dependencies or external input, and before an audit or questionnaire.\n- Re-running replaces `[slug]-owasp-top10-assessment.md`; carry forward the previous assessment's open findings with their status so nothing is silently dropped.\n\n## Notes\n\n- Point-in-time. OWASP revises the Top 10 periodically (2021 → 2025); confirm you are assessing against the current edition and re-rank prior assessments when a new edition lands.\n- This skill assesses against a taxonomy — it does not replace deep bug-hunting (Security Review) or threat modeling.\n- For API-heavy systems, add a short **OWASP API Security Top 10 (2023)** cross-map — it resolves object\u002Ffunction-level authz and resource-consumption risks the web list blurs.\n- Can run standalone (derives findings) or as a coverage layer over an existing Security Review (maps + supplements).\n",{"name":5,"effort":44,"context":45,"description":7,"argument-hint":46},"xhigh","fork","[system slug]","main","26f591c601503d32ccba54a6ddbcba75a00910c0","skills\u002Fowasp-top10-review",0,"https:\u002F\u002Fgithub.com\u002Fgener8v\u002Fgener8v.claude-skills","https:\u002F\u002Fgithub.com\u002Fgener8v","gener8v.com","2026-10-22 20:18:28",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add gener8v\u002Fgener8v.claude-skills --skill owasp-top10-review",{"tool":61,"command":62},"bunx","bunx skills add gener8v\u002Fgener8v.claude-skills --skill owasp-top10-review",{"tool":64,"command":65},"pnpm","pnpm dlx skills add gener8v\u002Fgener8v.claude-skills --skill owasp-top10-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgener8v\u002Fgener8v.claude-skills\u002Fblob\u002Fmain\u002Fskills\u002Fowasp-top10-review\u002FSKILL.md",true,[],[70,95,122,138,159,182],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":39},"01M6CQW5KKZVDJTN9VREPRFT06","ticket-breakdown","Decompose one capability area's requirements for one change into implementable tickets with Priority, Value, acceptance criteria, Prior Art, Output contracts, Known Hazards, dependency ordering and relative sizing: one TICKET-NNN.md per ticket plus backlog.md, in the change's tickets directory. Use when a specification is approved and the team needs work items, such as 'break this spec into tickets' or 'create the backlog for search'. Not for implementing a ticket (delivery) or ordering whole capability areas (dependencies).","https:\u002F\u002Fgithub.com\u002Fgener8v\u002Fgener8v.claude-skills\u002Fblob\u002Fmain\u002Fskills\u002Fticket-breakdown\u002FSKILL.md",[],[77,78,79,80,81,82,83,84,85,28,86,87,88,89,90,91,92,93,94],"ticket breakdown","directory","spec","change","create","acceptance","search","team","work","dependency","decompose","Art","specification","contracts","acceptance criteria","backlog","dependencies","delivery",{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":111,"publishedAt":39},"01M6CQW2XD2Q1JD7KFX944EH4W","technical-design","Translate specifications, constraints and dependencies into architecture decisions (AD-XXX), component boundaries, data model and interface contracts under .gener8v\u002Ftechnical-design\u002F. Use when technology or architecture choices must be settled before tickets are written, such as 'which datastore should we use' or 'design the components for search'. Skip it when the approach is obvious and uncontested. Not for judging an architecture that has already shipped (architecture-review).","https:\u002F\u002Fgithub.com\u002Fgener8v\u002Fgener8v.claude-skills\u002Fblob\u002Fmain\u002Fskills\u002Ftechnical-design\u002FSKILL.md",[101,106],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":107,"categoryName":108,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[112,113,114,21,115,116,117,118,83,119,120,22,30,121,28,90,93],"design","technical","technical design","translate","components","component","architecture","data","constraints","decisions",{"skillNo":123,"name":89,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":130,"publishedAt":39},"01M6CQVZY5JC08BEMTSSST1464","Expand one capability area from .gener8v\u002Fprd.md into a functional specification with atomic, testable [PREFIX]-REQ-XXX requirements, behaviors, edge cases and open questions under .gener8v\u002Fspecifications\u002F. Use when a PRD capability area needs elaboration before constraints, technical design or tickets, or a change brief still marks an area as pending specification, such as 'spec out the search area' or 'write the requirements for billing'. Not for the whole product (planning) or work items (ticket-breakdown).","https:\u002F\u002Fgithub.com\u002Fgener8v\u002Fgener8v.claude-skills\u002Fblob\u002Fmain\u002Fskills\u002Fspecification\u002FSKILL.md",[127],{"categoryNo":128,"categoryName":129,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000031","产品经理",[89,112,79,80,131,132,83,133,134,135,120,136,85,113,137,28],"planning","product","edge","brief","prd","open","write",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":39},"01M6CQVX5MJQWPEEWDMRC21ZEJ","setup","Bootstrap the gener8v pipeline in a project: create .gener8v\u002F, copy the conventions, generate pipeline-state.yaml, and add the pipeline directives to CLAUDE.md. Use when the user says 'set up gener8v' or 'initialize the pipeline', when a project has no .gener8v\u002Fprd.md, or after a plugin upgrade to refresh the conventions. Not for deciding what to do next on a project already on the pipeline (orchestrate).","https:\u002F\u002Fgithub.com\u002Fgener8v\u002Fgener8v.claude-skills\u002Fblob\u002Fmain\u002Fskills\u002Fsetup\u002FSKILL.md",[],[140,145,146,81,147,148,149,150,135,151,152,153,154,155,156,28,27,25,157,158],"plugin","bootstrap","generate","state","orchestrate","yaml","pipeline","SET","Bash","python3","initialize","refresh","next","upgrade",{"skillNo":160,"name":33,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":167,"publishedAt":39},"01M6CQVT9PZZ64TC456Y1FWF55","OWASP-informed, code-level security review of delivered code: injection, authentication and authorization, data exposure, configuration, dependencies, cryptography and logging, with attack scenarios for Medium+ findings and compliance constraints (CC-XXX) treated as Critical. Use after a delivery, especially one touching input handling, auth, sensitive data or external integrations, such as 'security review TICKET-007' or 'check what this delivery shipped for injection or auth bypass before we merge'. Not for a whole-codebase OWASP posture assessment (owasp-top10-review) or prompt-injection risk in LLM features (owasp-llm-top10-review).","https:\u002F\u002Fgithub.com\u002Fgener8v\u002Fgener8v.claude-skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-review\u002FSKILL.md",[164],{"categoryNo":165,"categoryName":166,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000037","律师与法务",[21,168,169,80,170,171,37,172,173,174,35,175,34,176,177,178,179,28,180,181],"security","security review","auth","merge","code","authentication","compliance","prompt-injection","risk","integrations","prompt","check","files","007",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":39},"01M6CQVPP78PF4SB9H5WAD3837","rot-watch","Detect decay in code that is being actively written: measure six signals (packaging drift, dependency direction, comment language, growth slopes, tests, the detectable subset of SOLID) against a recorded baseline and report only what moved, at .gener8v\u002Frot\u002F. Use once code has been delivered and again every few deliveries, before a release, or when asked 'is the codebase getting worse' or 'has this module drifted'. The first run records the baseline and reports nothing. Not for one delivery's quality (quality-review), defects (defect-sweep) or whether the architecture was right (architecture-review).","https:\u002F\u002Fgithub.com\u002Fgener8v\u002Fgener8v.claude-skills\u002Fblob\u002Fmain\u002Fskills\u002Frot-watch\u002FSKILL.md",[],[189,21,190,118,191,172,192,193,194,195,196,197,198,199,28,200,86,201,202,94],"rot watch","solid","run","report","release","first","baseline","sweep","quality","growth","packaging","only","reports","drift"]