Identify and prevent XSS, CSRF, SSRF, SQL Injection, Broken Access Control, and insecure direct object references.
Andromity loads skills from folders you trust. Install with andromity skill install owasp-security-audit — autonomy and approval limits stay configurable per session.
# Install the "OWASP Top 10 Security Audit" skill You are installing an AgenticMarket skill into this workspace. Follow these steps exactly. ## 1. Detect your environment and choose the destination file - Andromity: `.andromity/skills/owasp-security-audit/SKILL.md` (or user scope `~/.andromity/skills/owasp-security-audit/SKILL.md`) - Antigravity / Gemini CLI: `.agent/skills/owasp-security-audit/SKILL.md` - Cursor: `.cursor/rules/owasp-security-audit.mdc` - Claude Code: append to `CLAUDE.md` (or `.claude/skills/owasp-security-audit.md`) - Windsurf: append to `.windsurfrules` - Cline / Roo Code: `.clinerules/owasp-security-audit.md` - GitHub Copilot: append to `.github/copilot-instructions.md` - ChatGPT / web only: paste the content into Custom Instructions - Any other agent: save to `.agent/skills/owasp-security-audit/SKILL.md` ## 2. Create the destination file - Preserve every existing file and configuration entry. - Create parent folders as needed. - Never overwrite unrelated content. ## 3. Write exactly this content ```markdown --- name: owasp-security-audit description: "Identify and prevent XSS, CSRF, SSRF, SQL Injection, Broken Access Control, and insecure direct object references." author: community license: mit version: 1.0.0 --- # OWASP Top 10 Security Hardening Rules to secure web applications: 1. **Broken Access Control**: Verify user permissions on EVERY data query. 2. **Injection**: Never concatenate SQL, shell, or regex strings from user input. 3. **Cross-Site Scripting (XSS)**: Sanitize HTML content with `rehype-sanitize` or DOMPurify. 4. **Security Headers**: Send strict CSP, HSTS, X-Content-Type-Options, and Referrer-Policy headers. ``` ## 4. Verify - Confirm the file exists and is readable. - Report the destination path and confirm the "OWASP Top 10 Security Audit" skill is installed and active. Skill metadata: - Slug: owasp-security-audit - Category: security - License: mit - Source: AgenticMarket
Rules to secure web applications:
AgenticMarketrehype-sanitize or DOMPurify.Identify and prevent XSS, CSRF, SSRF, SQL Injection, Broken Access Control, and insecure direct object references.
OWASP Top 10 Security Audit works seamlessly with Cursor (.cursor/rules), Claude Code (CLAUDE.md & .claude/skills), Windsurf (.windsurfrules), Google Antigravity (.agent/skills), Andromity (.andromity/skills), and Cline.
Click '1-Click Prompt Install' in the right sidebar or copy the prompt into your agent chat (Cursor Composer, Claude Code, or Andromity). The agent automatically configures the skill instruction file into your workspace.
Yes, OWASP Top 10 Security Audit is 100% free and open-source under the mit license on AgenticMarket with no per-call fees or paywalls.
Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.
Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.
Use when a Head of Ops, Knowledge Manager, or TPM-Internal needs to author, validate, or clean up company SOPs and internal runbooks (procurement intake, vendor offboarding, incident-comms cascade, employee onboarding) — including 5W2H completeness checks (Who-What-When-Where-Why-How-HowMuch), cross-link and orphan-page validation across a sprawling Notion/Confluence/Obsidian wiki, KB ingestion + hygiene reporting, and runbook step verification (named owner, expected duration, observable success signal, rollback path, escalation contact). Pairs Ishikawa's 5W2H method, Gawande's *The Checklist Manifesto*, ISO 9001, ITIL v4, and Google SRE Workbook runbook discipline with deterministic stdlib-only Python tools that score completeness, detect anti-patterns, and emit prioritized cleanup lists (e.g., "validate this runbook before it goes into rotation", "audit our Confluence wiki for stale and orphaned SOPs").
