moai-ref-owasp-checklist

What problem does it solve? Backend developers and reviewers often miss common vulnerabilities like broken authorization, injection, or missing security headers because security knowledge is scattered. This Skill consolidates the OWASP API Security Top 10, authentication configuration guidance, input validation rules, and HTTP security headers into a single reference that agents can apply during implementation and security audits. ## Core Features & Use Cases - OWASP API Security Top 10 Checklist: Covers BOLA, broken authentication, SSRF, security misconfiguration, and more, each with a concrete check and defense. - Authentication & Session Guidance: Recommends bcrypt cost factors, JWT expiry settings, cookie attributes, and session handling rules. - Security Review Severity Model: Classifies findings from P0 (block release) to P3 (backlog) so teams can triage consistently. - Use Case: While reviewing a new API endpoint, an agent checks each OWASP item, verifies parameterized queries and security headers, and reports findings with severity levels and reason codes. ## Quick Start Ask the agent to review the current backend changes against the OWASP security checklist and report any findings with severity levels.