owasp-review
"OWASP Top-10 basics review for the Griot estate: injection (parameterized SQL), broken auth (refresh rotation), sensitive data (no localStorage tokens), CORS allow-list, AI principal scope."
Install
npx skillscat add donartkins/griot/owasp-review Install via the SkillsCat registry.
SKILL.md
OWASP Review Skill
Checklist (log per item)
- Injection - every Dapper/raw-SQL call parameterized.
- Broken auth - refresh rotation replay fails; Argon2 hashing.
- Sensitive data - no tokens in localStorage; cookie flags HttpOnly; Secure; SameSite.
- CORS - API only serves the Vercel origin in prod.
- AI surface - ai-agent principal scope (no deletes/invites); prompt-injection: user text as data.
Output
docs/OWASP-REVIEW.mdwith findings or "no issue found" per item; re-check on each auth/guard change.
Categories
Install
npx skillscat add donartkins/griot/owasp-review Install via the SkillsCat registry.