# Install the "OWASP Top 10 Security Audit" skill

You are installing an AgenticMarket skill into this workspace. Follow these steps exactly.

## 1. Detect your environment and choose the destination file
- Andromity: `.andromity/skills/owasp-security-audit/SKILL.md` (or user scope `~/.andromity/skills/owasp-security-audit/SKILL.md`)
- Antigravity / Gemini CLI: `.agent/skills/owasp-security-audit/SKILL.md`
- Cursor: `.cursor/rules/owasp-security-audit.mdc`
- Claude Code: append to `CLAUDE.md` (or `.claude/skills/owasp-security-audit.md`)
- Windsurf: append to `.windsurfrules`
- Cline / Roo Code: `.clinerules/owasp-security-audit.md`
- GitHub Copilot: append to `.github/copilot-instructions.md`
- ChatGPT / web only: paste the content into Custom Instructions
- Any other agent: save to `.agent/skills/owasp-security-audit/SKILL.md`

## 2. Create the destination file
- Preserve every existing file and configuration entry.
- Create parent folders as needed.
- Never overwrite unrelated content.

## 3. Write exactly this content

```markdown
---
name: owasp-security-audit
description: "Identify and prevent XSS, CSRF, SSRF, SQL Injection, Broken Access Control, and insecure direct object references."
author: community
license: mit
version: 1.0.0
---
# OWASP Top 10 Security Hardening

Rules to secure web applications:
1. **Broken Access Control**: Verify user permissions on EVERY data query.
2. **Injection**: Never concatenate SQL, shell, or regex strings from user input.
3. **Cross-Site Scripting (XSS)**: Sanitize HTML content with `rehype-sanitize` or DOMPurify.
4. **Security Headers**: Send strict CSP, HSTS, X-Content-Type-Options, and Referrer-Policy headers.
```

## 4. Verify
- Confirm the file exists and is readable.
- Report the destination path and confirm the "OWASP Top 10 Security Audit" skill is installed and active.

Skill metadata:
- Slug: owasp-security-audit
- Category: security
- License: mit
- Source: AgenticMarket