OWASP and STRIDE Security Audit skill for Claude and Codex

OWASP and STRIDE Security Audit as an AI skill. It asks for Application summary, Architecture, Authentication method and 3 more, then does the rest. Free to…

Install it once and Claude or Codex runs it for you. When your request matches, your AI loads the skill, asks for anything it is missing, and works through the template itself. Prefer to fill it in by hand? See the full prompt template.

Download the skill (.zip) · View SKILL.md

When it is used

Use when a developer or tech lead needs a structured security audit of a web app or API, ranked by how easily each weakness can be exploited. Do not use for penetration testing a live system or a compliance certification. Related topics: coding, technical.

What it will ask you for

• Application summary (longer free text)
• Architecture (longer free text)
• Authentication method (choose one: Sessions, JWT, OAuth, API keys, None yet)
• Sensitive data handled (choose any: Personal data, Payments, Health data, Credentials, Business secrets)
• Code or config to review (longer free text)
• Audit depth (choose one: Quick scan, Standard, Deep)

How it works

1. Map entry points, data stores, and trust boundaries from the architecture description.
2. Check each OWASP Top 10 category against the map and note which ones apply.
3. Apply the six STRIDE threats to every trust boundary.
4. Write each finding with location, attack, preconditions, severity, and fix, ranked by exploitability then impact.
5. List the top three fixes to ship first and the areas that could not be assessed.

What you get

A system map, a findings table ranked by exploitability with severity and fix, the top three fixes, and a list of unassessed areas.

What it watches out for

• Ranking by category order instead of exploitability, so a hard-to-reach flaw outranks an open endpoint.
• Listing theoretical threats with no precondition, which hides which ones are real.
• Silently skipping areas that lacked code, instead of listing them as unassessed.

How to install

Claude.ai and the Claude desktop app

1. Download the skill .zip.
2. Open Settings, then Capabilities, and find Skills.
3. Choose Upload skill and select the .zip.
4. Ask Claude for help with the task. It loads the skill when your request matches.

Claude Code

1. Download the skill .zip.
2. Unzip it into ~/.claude/skills/ (or .claude/skills/ inside a project).
3. Start a new session. Claude Code loads the skill when your request matches.

Codex

1. Download the skill .zip.
2. Unzip it into ~/.agents/skills/ (or .agents/skills/ inside a project).
3. Codex picks it up on its own. Type $ and the skill name to use it, or just ask for the task.

Cursor

1. Download the Cursor rule (.mdc).
2. Save it in .cursor/rules/ inside your project.
3. Cursor's agent applies the rule when your request matches its description.

AGENTS.md (Codex, Cursor, and other coding agents)

1. Copy the AGENTS.md section.
2. Paste it into AGENTS.md at the root of your repository, creating the file if needed.
3. Coding agents that read AGENTS.md follow it when your request fits.