/owasp-top10

name: memstack-security-owasp-top10
description: "Use this skill when the user says 'OWASP audit', 'OWASP top 10', 'security audit', 'vulnerability assessment', 'full security check', or needs a comprehensive web application security review against OWASP Top 10 categories. Do NOT use for dependency audits or secret scanning alone."
version: 1.0.0
license: "Proprietary, MemStack™ Pro by CW Affiliate Investments LLC. See LICENSE.txt"

🛡️ OWASP Top 10: Running Full Vulnerability Assessment...

*Audit a web application against the OWASP Top 10 (2021) vulnerability categories with actionable findings and remediation.*

Activation

When this skill activates, output:

`🛡️ OWASP Top 10: Running Full Vulnerability Assessment...`

Then execute the protocol below.

Context Guard

| Context | Status | |---------|--------| | **User asks for OWASP/security audit** | ACTIVE: full assessment | | **User asks for vulnerability check** | ACTIVE: full assessment | | **Pre-launch security review** | ACTIVE: full assessment | | **User asks about a specific OWASP category** | ACTIVE, targeted check for that category | | **User is actively fixing a vulnerability** | DORMANT: let them work |

Scan Modes

This skill supports two modes. Default to **deep scan** unless the user specifies otherwise.

| Mode | Scope | When to use | |------|-------|-------------| | **Quick scan** | A01 (auth), A05 (headers + config), A06 (deps) | Fast pre-deploy check, CI pipeline gate, or first-pass triage | | **Deep scan** | All 10 categories | Pre-launch review, security audit, compliance check |

If the user says "quick OWASP", "quick security check", or "fast scan", run only A01 + A05 + A06 and output the scorecard with the other 7 categories marked as "⏭️ SKIPPED (quick mode)".

Protocol

Run each of the 10 checks below (or A01 + A05 + A06 only in quick mode). For each, search the codebase for vulnerability patterns, classify findings, and record results for the final scorecard.

**Finding format:** Every finding MUST include a file path and line number in the format `file:line`. If a finding is project-wide (e.g., "no rate limiting anywhere"), reference the most relevant file where the fix would be applied. Vague findings like "missing HSTS" without pointing to the middleware or config file are not actionable.

---

A01: Broken Access Control

**Risk:** Users acting beyond their intended permissions: accessing other users' data, elevating privileges, or bypassing access restrictions.

**Detection:**

1. **Missing auth on routes:** Find all API route files, then check each for authentication patterns (`getAuthContext`, `getSession`, `auth()`, or equivalent).

2. **Insecure Direct Object References (IDOR):** Search for routes that take an ID parameter (`params.id`, `params.userId`, `params.orgId`) and fetch data without verifying the authenticated user owns or has access to the referenced resource.

3. **Privilege escalation:** Search for role checks (`role.*admin`, `isAdmin`, `requireRole`). Verify admin-only operations actually enforce role checks, not just rely on route naming.

4. **CORS bypass:** Search for `Access-Control-Allow-Origin` headers. Flag wildcard (`*`) with credentials enabled.

**Cross-reference:** Run `api-audit` (Checks 1-2) for detailed route-by-route auth analysis.

**Remediation:**

• Add auth middleware to all non-public routes
• Always derive user/org context from session, never from request parameters
• Implement RBAC (Role-Based Access Control) for admin operations
• Deny by default, explicitly allow, don't explicitly deny

---

A02: Cryptographic Failures

**Risk:** Exposure of sensitive data due to weak or missing encryption.

**Detection:**

1. **Weak hashing:** Search for `md5`, `sha1`, `createHash('md5')`, `createHash('sha1')` in source files. MD5/SHA1 for passwords is CRITICAL. For checksums/cache keys it's acceptable (INFO).

2. **Unencrypted sensitive data:** Search for password assignment patterns. Verify passwords use bcrypt/argon2/scrypt, not plaintext or weak hashing.

3. **No HTTPS enforcement:** Check `next.config.js` or middleware for HTTPS redirect, `x-forwarded-proto` checks, `Strict-Transport-Security` header.

4. **Sensitive data in URLs:** Search for `token=`, `password=`, `secret=`, `key=` in URL/redirect/query string contexts.

**Remediation:**

• Use bcrypt/argon2 for password hashing (cost factor >= 10)
• Enforce HTTPS via HSTS header or middleware redirect
• Never pass secrets in query strings, use headers or POST body
• Encrypt sensitive data at rest (database-level or application-level)

---

A03: Injection

**Risk:** Untrusted data sent to an interpreter as part of a command or query.

**Detection:**

1. **SQL injection:** Search for template literals with interpolated variables inside SQL query/execute calls. Search for string concatenation in SELECT/INSERT/UPDATE/DELETE statements.

2. **Cross-Site Scripting (XSS):** Search for `dangerouslySetInnerHTML`, `innerHTML`, `__html` in React/JSX files. Search for `v-html` in Vue files.

3. **Command injection:** Search for shell execution imports (`child_process`) and calls (`execSync`, `spawn`). Verify user input is never passed to shell commands. Use `execFile` with argument arrays instead.

4. **Dynamic code execution:** Search for `new Function(` with dynamic strings, `setTimeout`/`setInterval` with string arguments instead of function references. These allow arbitrary code execution if user input reaches them.

**Cross-reference:** Run `api-audit` (Check 5) for detailed SQL injection analysis.

**Remediation:**

• Use parameterized queries or ORM methods exclusively
• Use React's default JSX escaping: avoid `dangerouslySetInnerHTML`
• Sanitize HTML with DOMPurify if raw HTML rendering is required
• Never pass user input to shell execution, use `execFile()` with argument arrays

---

A04: Insecure Design

**Risk:** Missing or ineffective security cont