---
name: owasp-and-stride-security-audit
description: "Audits an application against the OWASP Top 10 and STRIDE threats, returning findings ranked by how easily each can be exploited. Use when a developer or tech lead needs a structured security audit of a web app or API, ranked by how easily each weakness can be exploited. Do not use for penetration testing a live system or a compliance certification. Related topics: coding, technical."
---

# OWASP and STRIDE Security Audit

Audits an application against the OWASP Top 10 and STRIDE threats, returning findings ranked by how easily each can be exploited.

## When to use

Use this skill when a developer or tech lead needs a structured security audit of a web app or API, ranked by how easily each weakness can be exploited. Do not use it for penetration testing a live system or a compliance certification.

## Workflow

1. Ask the user for each input listed below in a single message, skipping any they have already given. Where options are listed, offer them, but accept other answers too.
2. Map entry points, data stores, and trust boundaries from the architecture description.
3. Check each OWASP Top 10 category against the map and note which ones apply.
4. Apply the six STRIDE threats to every trust boundary.
5. Write each finding with location, attack, preconditions, severity, and fix, ranked by exploitability then impact.
6. List the top three fixes to ship first and the areas that could not be assessed.

## Inputs

- **Application summary** (longer free text)
- **Architecture** (longer free text)
- **Authentication method** (choose one: Sessions, JWT, OAuth, API keys, None yet)
- **Sensitive data handled** (choose any: Personal data, Payments, Health data, Credentials, Business secrets)
- **Code or config to review** (longer free text)
- **Audit depth** (choose one: Quick scan, Standard, Deep)

## Output

A system map, a findings table ranked by exploitability with severity and fix, the top three fixes, and a list of unassessed areas.

## Prompt template

Fill the inputs into this template and follow it as the full instruction.

### OWASP and STRIDE Security Audit

Audit my application for security weaknesses.

- Application summary: {{Application summary}}
- Architecture: {{Architecture}}
- Authentication method: {{Authentication method}}
- Sensitive data handled: {{Sensitive data handled}}
- Code or config to review: {{Code or config to review}}
- Audit depth: {{Audit depth}}

Map the system into entry points, data stores, and trust boundaries. Walk each of the OWASP Top 10 categories against that map and note which apply. Then apply STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) to each trust boundary. For every finding give the location, the attack in two sentences, the preconditions, and the fix. Rank by exploitability first (unauthenticated and remote beats local and privileged), then by impact. Give a severity of Critical, High, Medium, or Low. Do not request or paste real secrets: refer to them by name only. End with the top three fixes to ship first and a list of areas you could not assess.

## Pitfalls

- Ranking by category order instead of exploitability, so a hard-to-reach flaw outranks an open endpoint.
- Listing theoretical threats with no precondition, which hides which ones are real.
- Silently skipping areas that lacked code, instead of listing them as unassessed.