Outskill Owasp Security Review — Security skill for Claude Code

OWASP Security Review — a Claude Code Skill

A plug-in **[Claude Code](https://claude.com/claude-code) skill** that runs a launch-gate **security review against the [OWASP Top 10 (2025)](https://owasp.org/Top10/)** on a Next.js + Supabase + OpenAI codebase — and explains every finding in plain language, so a non-coder can act on it.

It was purpose-built for the **[Vibe CRM Security Lab](https://github.com/harshith-vaddiparthy/vibe-crm-security-lab)** (a deliberately-vulnerable teaching CRM), but the methodology and the per-category checklist work as a general OWASP-2025 review for any modern Next.js App Router + Supabase app.

**TL;DR** — Type `/owasp-security-review` in Claude Code. It maps all 10 OWASP 2025 risks to the exact files in your repo, rates severity, and points at the concrete fix — no security jargon required.

---

Why this exists

Most "AI security review" is generic: it lists the OWASP Top 10 and hand-waves. This skill is the opposite — it is **grounded in one real codebase**. Every finding names a real file, a real line of reasoning, and (where the lab provides one) the **correct version already sitting next to the broken one**.

It's written for an owner who **prompts but doesn't read code**. So instead of "IDOR on the contact endpoint," it says: *"Anyone can read another company's customer by changing a number in the web address — here's the file, here's why it's a breach with real data, here's the one-line fix."*

---

How it was built (multi-agent, verified)

This skill isn't hand-waved from memory. It was generated by an orchestrated **25-subagent audit**:

1. Recon (5 agents in parallel) — one agent extracted the real OWASP Top 10 2025 list from the official source docs (not from training data); four dissected the target app's architecture, authentication/access-control, data/API layer, and secrets/config posture.
2. Map (10 agents) — one agent per OWASP 2025 category cross-referenced the category against the codebase and