---
name: code-review-security
slug: owasp-security-skills
score: 49
rubric: 1.0
provenance: verified-org
publisher: OWASP Foundation
license: CC-BY-4.0
capability: read-only
canonical: https://top-agent-skills.com/skill/owasp-security-skills
---

# code-review-security

OWASP-published review, SCA, secrets and threat-modelling skills — the most citable provenance available for security review vocabulary.

## Install

### Claude Code

```bash
/plugin marketplace add OWASP/secure-agent-playbook
```

## Best for

Pre-merge security gates mapped to a standard a reviewer can cite, and threat modelling multi-agent systems against the OWASP Multi-Agentic guide and CSA MAESTRO layers.

## Not ideal for

Vendoring into a product. The bundle is CC-BY-4.0 — a content licence, not a software licence — so check your obligations before redistributing the rules.

## About

Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization. The same plugin bundle adds sca-audit for dependency CVEs, secrets-scan for credential exposure, and multi-agentic-threat-model for threat modelling multi-agent systems against the CSA MAESTRO framework.

## Compatibility

claude-code

## Metadata

- Categories: security-auditing, code-quality-review
- Surfaces: claude-code
- Tags: OWASP, Threat modeling, ASVS
- Setup time: 3 min
- Complexity: Low
- Last update: 2026-06-02
- Verified: —
- Source: https://github.com/OWASP/secure-agent-playbook/tree/main/plugins/code-security-skills
- Docs: https://github.com/OWASP/secure-agent-playbook/blob/main/plugins/code-security-skills/skills/code-review-security/SKILL.md

---

_Indexed by Top Agent Skills. Score breakdown: https://top-agent-skills.com/about/methodology_