Chalk Labs
Need help deploying owasp-review?
Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/archive228-owasp-review
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: security
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/owasp-review
What's inside
- Skill name
owasp-review- Description
- Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.
- License
- MIT
- Instructions
- 11 lines in SKILL.md · view on GitHub
Files (1)
- SKILL.md
SKILL.md (first lines)
# OWASP Review
Check the diff for each, with the exact line:
- **Injection** — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
- **Broken access control** — does it verify the user OWNS the resource, not just that they're logged in?
- **Auth** — secrets in code? tokens without expiry? password compare not constant-time?
- **SSRF** — user-controlled URL fetched server-side without an allowlist.
- **Sensitive data** — PII/secrets logged, returned in errors, or sent unencrypted.
- **Deserialization** — untrusted input into pickle/yaml.load/eval.
- **Dependency** — a new package with known CVEs or no maintenance.
Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".From Archive228/loopkit, MIT.
More from Archive228/loopkit
- 0.701score
structured-output
Archive228
Get JSON out of the model reliably.
SkillCFreshness: C★ 755Claude Code +9 - 0.701score
prompt-caching
Archive228
Cache the parts of the prompt that don't change so a long-running loop stops paying full price on every turn.
SkillCFreshness: C★ 755Claude Code +9 - 0.701score
using-loopkit
Archive228
Use when starting any conversation in a loopkit-enabled project - establishes how to find and use loopkit's 49 skills, requiring skill invocation before ANY…
SkillCFreshness: C★ 755Claude Code +9 - 0.701score
hitl-escalate
Archive228
Escalate blocked runs to a human via configured channel or fallback to BLOCKED.md and exit the loop.
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
active-memory-reminder
Archive228
Before compaction Loopkit extracts decisions into claude-decisions.json (machine-readable).
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
broken-window-check
Archive228
Before picking new work, smoke-test the last "completed" feature.
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
model-routing
Archive228
Split the Plan/Act/Verify loop across three model tiers — frontier planner, cheap executor, frontier judge — via env vars read by run.sh.
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
adversarial-verify
Archive228
Review a diff against the goal spec assuming the code is BROKEN.
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
feature-list-json
Archive228
Enumerate every end-to-end feature as strict JSON entries with passes:false, editable-passes-only discipline, and priority order.
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
evaluator-calibration
Archive228
Calibrate a reviewer persona with few-shot rubric examples so skepticism stays consistent and doesn't drift lenient over long runs.
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
harness-stripping
Archive228
Systematically remove one harness component at a time and measure impact, killing scaffolding that no longer earns its complexity.
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
eval-harness
Archive228
Build a repeatable eval loop that grades agent output with an LLM judge, so prompt/skill changes get scored against a baseline instead of eyeballed.
SkillCFreshness: C★ 755Claude Code +9
Signals
- Stars
- 755
- Forks
- 124
- Open issues
- 0
- Last commit (this folder)
- Jun 29, 2026 (4 months ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- MIT
- Repository
- github.com/Archive228/loopkit
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from Archive228
- 0.701score
structured-output
Archive228
Get JSON out of the model reliably.
SkillCFreshness: C★ 755Claude Code +9 - 0.701score
using-loopkit
Archive228
Use when starting any conversation in a loopkit-enabled project - establishes how to find and use loopkit's 49 skills, requiring skill invocation before ANY…
SkillCFreshness: C★ 755Claude Code +9 - 0.701score
hitl-escalate
Archive228
Escalate blocked runs to a human via configured channel or fallback to BLOCKED.md and exit the loop.
SkillCFreshness: C★ 755Claude Code +9 - 0.701score
prompt-caching
Archive228
Cache the parts of the prompt that don't change so a long-running loop stops paying full price on every turn.
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
harness-stripping
Archive228
Systematically remove one harness component at a time and measure impact, killing scaffolding that no longer earns its complexity.
SkillCFreshness: C★ 755Claude Code +9 - 0.698score
broken-window-check
Archive228
Before picking new work, smoke-test the last "completed" feature.
SkillCFreshness: C★ 755Claude Code +9
Done for you
Rather not set it up yourself?
Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.
See how we build AI agents →Read the case studies
Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.
- launches shipped
- 50+
- launches shipped
- media placements
- 500+
- media placements
- founders on every account
- 2
- founders on every account
Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block
Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.
Get owasp-review running in your business
Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.
Cite this page
owasp-review skill. Agent Mart. https://agentmart.dev/skills/archive228-owasp-review (last updated 2026-10-24)