agentrigs
+ submit rig
~ / rigs / agamm / claude-code-owasp

agamm/claude-code-owasp

Claude Code skill for OWASP security best practices (2025-2026). Includes Top 10:2025, ASVS 5.0, Agentic AI security, and 20+ language-specific security quirks.

↗ GitHub ★ 233 mit updated 4mo ago project Claude Code Claude plugin
share on X
ARCHETYPE
Minimalist
Lean instructions, few tools, tiny context tax. Lets the model think.
CONTEXT TAX · EVERY TURN
~380 tokens
Featherweight · median rig: 2.3k · breakdown
GUARDRAILS
0/5
No committed guardrails · details

Copy this rig

# review before running: this installs third-party code
$ npx degit agamm/claude-code-owasp/.claude ./rig-claude-code-owasp  # inspect, then merge into .claude/

MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.

$ npx degit agamm/claude-code-owasp/.claude/skills/owasp-security .claude/skills/owasp-security

This rig commits no guardrails. Here is the community baseline instead — the deny/ask rules most often found across all 6,974 rigs:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(**/.env)",
      "Read(~/.ssh/**)",
      "Bash(rm -rf *)",
      "Read(**/*.pem)",
      "Bash(rm -rf /)",
      "Bash(git push --force:*)",
      "Bash(sudo *)",
      "Read(~/.aws/**)",
      "Bash(rm -rf /*)",
      "Read(./.env.*)",
      "Read(.env)",
      "Bash(git push --force*)",
      "Bash(rm -rf:*)",
      "Read(**/.env.*)",
      "Read(**/*.key)",
      "Bash(sudo:*)",
      "Bash(git reset --hard*)",
      "Bash(git reset --hard:*)",
      "Read(.env.*)"
    ],
    "ask": [
      "Bash(git push:*)",
      "Bash(git push *)",
      "Bash(git commit:*)",
      "Bash(rm *)",
      "Bash(rm:*)",
      "Bash(npm publish:*)",
      "Bash(wget *)",
      "Bash(git rebase *)",
      "Bash(gh pr merge *)",
      "Bash(git commit *)"
    ]
  }
}

Skills (1)

owasp-security

Similar rigs

davila7/claude-code-templates
CLI tool for configuring and monitoring Claude Code
★ 32.3k project Claude CodeCodex 27 mcp 3 skills 15 agents 21 hooks 7d ago
YOLO Cowboy 80.9k tok ·
qepilot/qepilot-stack
QEPilot Stack — a browsable catalogue of Claude Code agents, commands, skills, MCPs and hooks. Fork of the MIT-licensed claude-code-templates by Daniel (San) Ávila.
★ 0 project Claude CodeCodex 27 mcp 3 skills 15 agents 21 hooks today
YOLO Cowboy 78.0k tok ·
koutsosg/claude-dotfiles
Portable Claude Code setup — global rules, 25+ skills, DevOps plugins, and install scripts for any machine or project.
★ 1 setup Claude Code 60 skills 6mo ago
Skill Collector 4.0k tok ·
georgekhananaev/claude-skills-vault
A curated collection of high impact skills for Claude Code designed to supercharge the senior full stack workflow. This vault automates the repetitive parts of development like architectural reviews, TDD cycles, and PR management so you can
★ 27 project Claude CodeCodex 1 mcp 90 skills 2mo ago
Skill Collector 6.6k tok ·
copied ✓