OWASP Security Gate (Meta-Skill)

This skill runs all ten OWASP Top 10 (2021) checks in sequence. Use it before a feature ships, before a PR is marked ready for review, or any time a full security review is needed.

Each check below maps to a dedicated skill. Run them in order. Mark each CLEAR or BLOCKED. If any check is BLOCKED, the feature does not ship until it is resolved.

Run in Sequence

A01 — Broken Access Control

Apply broken-access-control skill. Trigger: any code that retrieves, modifies, or deletes user data.

Key questions:

• Is object-level authorization enforced? (No IDOR)
• Is the access control check server-side?
• Does access default to deny?