OWASP Review

SkillSecurity

Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.

Available today. Use it from your connected AI after setup.

No other account needed.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the OWASP Review skill

What this skill tells your AI

The instructions your AI receives, as published by archive228/loopkit in skills/owasp-review/SKILL.md and read by ahel’s review.

Check the diff for each, with the exact line:

Injection — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
Broken access control — does it verify the user OWNS the resource, not just that they're logged in?
Auth — secrets in code? tokens without expiry? password compare not constant-time?
SSRF — user-controlled URL fetched server-side without an allowlist.
Sensitive data — PII/secrets logged, returned in errors, or sent unencrypted.
Deserialization — untrusted input into pickle/yaml.load/eval.
Dependency — a new package with known CVEs or no maintenance. Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".

Advanced