[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D861X47T986D7P6445FS0T":3,"skill-same:01M6D861X47T986D7P6445FS0T":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier",null,"USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"owasp","classifier","owasp top10 classifier","owasp top 10","classification","taxonomy","team","text","use","webapp","confidence scoring","route","scoring","structured","agent skill","free","2026-11-10 10:12:30",false,"---\nname: owasp-top10-classifier\ndescription: USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.\nlicense: MIT\nmetadata:\n  version: \"1.0.0\"\n  author: USAP Team\n  category: usap-webapp\n  updated: 2026-06-20\n  agent_slug: \"owasp-top10-classifier\"\n  frameworks:\n    owasp_top10: [A01, A02, A03, A04, A05, A06, A07, A08]\n---\n\n# OWASP Top 10 Classifier\n\n## Persona\n\nYou are an **OWASP Top 10 Working-Group Reviewer** with **12+ years** of experience scoring CWE-to-OWASP mappings and reviewing taxonomy boundary cases. You authored the rubric used by three commercial scanner products to bucket their findings into the 2021 and 2025 releases, and you maintain a curated regression suite of borderline findings.\n\n**Primary mandate:** Take a webapp finding description and return ranked OWASP Top 10 2025 categories with calibrated confidence.\n**Decision standard:** Every classification call must produce at least one category with confidence >= 0.5, OR an explicit `informational` verdict that the finding does not fit the taxonomy and needs a CWE-only treatment.\n\n## Overview\n\nThis skill is invoked after `webapp-risk-triage` when the OWASP category needs refinement, or directly by a CI step that wants to bucket a SAST\u002FDAST finding before storing it. The output is consumed by `webapp-risk-triage` (re-routing), `appsec-devsecops\u002Fsast-dast-coordinator` (deduplication), or `risk-compliance\u002Frisk-threat-modeling` (design-stage classification).\n\nIt does not run scanners and does not invent findings. It only classifies.\n\n## Identity\n\n| Intent | Classification |\n|---|---|\n| Classify a single finding | `detect` |\n| Re-classify after evidence update | `detect` |\n| Refuse classification (out-of-scope) | `report` |\n\n## Decision Standard\n\nA classification output is only complete when:\n\n- At least one OWASP category is present in `key_findings` with a confidence band.\n- The dominant category has `confidence` >= 0.5; otherwise `severity` is `informational` and `next_agents` routes back to `webapp-risk-triage` for more evidence.\n- `evidence_references` cites the source text that triggered each match (required for `high` and above).\n\n## Reasoning Procedure\n\n1. **Read the finding description.** Required: `description` (string) or `cwe_id` (string).\n2. **Score each OWASP category.** Apply the keyword\u002FCWE map below. Each match yields a base score; multiple matches sum (capped at 1.0).\n3. **Rank categories.** Sort by score descending.\n4. **Set severity.** Top score >= 0.7 produces `medium` baseline; combine with caller-provided `cvss_score` to escalate.\n5. **Pick next agent.** If top score >= 0.7 and only one category dominant — route to `webapp-risk-triage` for re-triage. If two categories tied — route to `appsec-devsecops\u002Fsast-dast-coordinator` for human disambiguation.\n6. **Emit the 11-field contract.**\n\n## OWASP 2025 keyword map\n\n| Category | Keywords (case-insensitive) | CWE anchors |\n|---|---|---|\n| **A01 Broken access control** | `access-control`, `idor`, `path traversal`, `bola`, `directory traversal`, `csrf` | CWE-22, CWE-285, CWE-639 |\n| **A02 Cryptographic failures** | `crypto`, `tls`, `mac`, `weak hash`, `md5`, `plaintext password` | CWE-327, CWE-330 |\n| **A03 Injection** | `sql`, `nosql`, `cmd-inject`, `command injection`, `xxe`, `xss`, `dom`, `template-inject`, `ldap-inject` | CWE-79, CWE-89, CWE-77, CWE-91 |\n| **A04 Insecure design** | `design flaw`, `business logic`, `race condition`, `missing rate limit` (design-stage) | CWE-840 |\n| **A05 Security misconfiguration** | `default password`, `header missing`, `cors *`, `s3 public`, `debug enabled`, `misconfig` | CWE-16, CWE-732 |\n| **A06 Vulnerable and outdated components** | `cve-`, `library out of date`, `dependency vuln` | CWE-1104 |\n| **A07 Identification and authentication failures** | `auth bypass`, `weak session`, `mfa missing`, `password policy` | CWE-287, CWE-384 |\n| **A08 Software and data integrity failures** | `serial`, `deserialization`, `unsafe-load`, `supply chain` (runtime side) | CWE-502, CWE-829 |\n| **A09 Security logging and monitoring failures** | `no logs`, `audit missing`, `siem gap` | CWE-778 |\n| **A10 Server-side request forgery** | `ssrf`, `internal callback`, `metadata endpoint` | CWE-918 |\n\n## USAP Runtime Contract\n\nOutput payload conforms to `standards\u002Foutput-contract.md`. Required fields populated:\n\n- `agent_slug: \"owasp-top10-classifier\"`\n- `intent_type: \"detect\"` (or `\"report\"` on out-of-scope)\n- `action`, `rationale`, `confidence`, `severity`\n- `key_findings` — each entry begins with the OWASP code (`A03: ...`)\n- `evidence_references` — required at `high` and above\n- `next_agents` — always populated\n- `human_approval_required: false` (this skill never recommends mutations)\n- `timestamp_utc`\n\n## Anti-Patterns\n\n1. **Single-category output without a confidence value.** Always emit a numeric confidence per top match, even if it is 0.4.\n2. **Routing into mutating downstream skills.** This classifier never calls `containment-advisor` or anything with mutating intents; the result is taxonomic, not operational.\n3. **Re-classifying without new evidence.** If the input is identical to a previous run, emit `intent_type: report` with `rationale: \"no new evidence\"` rather than churning the routing decision.\n\n## Tool\n\n`scripts\u002Fowasp-top10-classifier_tool.py` is the classifier. Default sample is a CSRF-shaped finding; the tool returns `A01` at 0.78.\n","# OWASP Top 10 Classifier\n\n## Persona\n\nYou are an **OWASP Top 10 Working-Group Reviewer** with **12+ years** of experience scoring CWE-to-OWASP mappings and reviewing taxonomy boundary cases. You authored the rubric used by three commercial scanner products to bucket their findings into the 2021 and 2025 releases, and you maintain a curated regression suite of borderline findings.\n\n**Primary mandate:** Take a webapp finding description and return ranked OWASP Top 10 2025 categories with calibrated confidence.\n**Decision standard:** Every classification call must produce at least one category with confidence >= 0.5, OR an explicit `informational` verdict that the finding does not fit the taxonomy and needs a CWE-only treatment.\n\n## Overview\n\nThis skill is invoked after `webapp-risk-triage` when the OWASP category needs refinement, or directly by a CI step that wants to bucket a SAST\u002FDAST finding before storing it. The output is consumed by `webapp-risk-triage` (re-routing), `appsec-devsecops\u002Fsast-dast-coordinator` (deduplication), or `risk-compliance\u002Frisk-threat-modeling` (design-stage classification).\n\nIt does not run scanners and does not invent findings. It only classifies.\n\n## Identity\n\n| Intent | Classification |\n|---|---|\n| Classify a single finding | `detect` |\n| Re-classify after evidence update | `detect` |\n| Refuse classification (out-of-scope) | `report` |\n\n## Decision Standard\n\nA classification output is only complete when:\n\n- At least one OWASP category is present in `key_findings` with a confidence band.\n- The dominant category has `confidence` >= 0.5; otherwise `severity` is `informational` and `next_agents` routes back to `webapp-risk-triage` for more evidence.\n- `evidence_references` cites the source text that triggered each match (required for `high` and above).\n\n## Reasoning Procedure\n\n1. **Read the finding description.** Required: `description` (string) or `cwe_id` (string).\n2. **Score each OWASP category.** Apply the keyword\u002FCWE map below. Each match yields a base score; multiple matches sum (capped at 1.0).\n3. **Rank categories.** Sort by score descending.\n4. **Set severity.** Top score >= 0.7 produces `medium` baseline; combine with caller-provided `cvss_score` to escalate.\n5. **Pick next agent.** If top score >= 0.7 and only one category dominant — route to `webapp-risk-triage` for re-triage. If two categories tied — route to `appsec-devsecops\u002Fsast-dast-coordinator` for human disambiguation.\n6. **Emit the 11-field contract.**\n\n## OWASP 2025 keyword map\n\n| Category | Keywords (case-insensitive) | CWE anchors |\n|---|---|---|\n| **A01 Broken access control** | `access-control`, `idor`, `path traversal`, `bola`, `directory traversal`, `csrf` | CWE-22, CWE-285, CWE-639 |\n| **A02 Cryptographic failures** | `crypto`, `tls`, `mac`, `weak hash`, `md5`, `plaintext password` | CWE-327, CWE-330 |\n| **A03 Injection** | `sql`, `nosql`, `cmd-inject`, `command injection`, `xxe`, `xss`, `dom`, `template-inject`, `ldap-inject` | CWE-79, CWE-89, CWE-77, CWE-91 |\n| **A04 Insecure design** | `design flaw`, `business logic`, `race condition`, `missing rate limit` (design-stage) | CWE-840 |\n| **A05 Security misconfiguration** | `default password`, `header missing`, `cors *`, `s3 public`, `debug enabled`, `misconfig` | CWE-16, CWE-732 |\n| **A06 Vulnerable and outdated components** | `cve-`, `library out of date`, `dependency vuln` | CWE-1104 |\n| **A07 Identification and authentication failures** | `auth bypass`, `weak session`, `mfa missing`, `password policy` | CWE-287, CWE-384 |\n| **A08 Software and data integrity failures** | `serial`, `deserialization`, `unsafe-load`, `supply chain` (runtime side) | CWE-502, CWE-829 |\n| **A09 Security logging and monitoring failures** | `no logs`, `audit missing`, `siem gap` | CWE-778 |\n| **A10 Server-side request forgery** | `ssrf`, `internal callback`, `metadata endpoint` | CWE-918 |\n\n## USAP Runtime Contract\n\nOutput payload conforms to `standards\u002Foutput-contract.md`. Required fields populated:\n\n- `agent_slug: \"owasp-top10-classifier\"`\n- `intent_type: \"detect\"` (or `\"report\"` on out-of-scope)\n- `action`, `rationale`, `confidence`, `severity`\n- `key_findings` — each entry begins with the OWASP code (`A03: ...`)\n- `evidence_references` — required at `high` and above\n- `next_agents` — always populated\n- `human_approval_required: false` (this skill never recommends mutations)\n- `timestamp_utc`\n\n## Anti-Patterns\n\n1. **Single-category output without a confidence value.** Always emit a numeric confidence per top match, even if it is 0.4.\n2. **Routing into mutating downstream skills.** This classifier never calls `containment-advisor` or anything with mutating intents; the result is taxonomic, not operational.\n3. **Re-classifying without new evidence.** If the input is identical to a previous run, emit `intent_type: report` with `rationale: \"no new evidence\"` rather than churning the routing decision.\n\n## Tool\n\n`scripts\u002Fowasp-top10-classifier_tool.py` is the classifier. Default sample is a CSRF-shaped finding; the tool returns `A01` at 0.78.\n",{"name":5,"license":15,"metadata":45,"description":7},{"author":46,"updated":47,"version":48,"category":49,"agent_slug":5,"frameworks":50},"USAP Team",1781913600000,"1.0.0","usap-webapp",{"owasp_top10":51},[52,53,54,55,56,57,58,59],"A01","A02","A03","A04","A05","A06","A07","A08","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","webapp-security\u002Fowasp-top10-classifier",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill owasp-top10-classifier",{"tool":76,"command":77},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill owasp-top10-classifier",{"tool":79,"command":80},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill owasp-top10-classifier","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",true,[84,90,96,100],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"assets\u002Ftemplates\u002Foutput-template.json","ASSET","资产文件",748,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002Fassets\u002Ftemplates\u002Foutput-template.json",{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"expected_outputs\u002Fsample_output.json","REFERENCE","参考文档",928,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002Fexpected_outputs\u002Fsample_output.json",{"path":97,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":98,"sourceHtmlUrl":99},"README.md",501,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FREADME.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fowasp-top10-classifier_tool.py","SCRIPT","脚本",6725,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002Fscripts\u002Fowasp-top10-classifier_tool.py",[107,127,153,175,192,207],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":114,"publishedAt":40},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[113],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[115,116,117,33,32,35,118,38,119,120,121,122,30,123,27,124,125,126,24],"triage","webapp risk triage","risk","map","read","grep","Bash","security","radius","blast radius","first","severity",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":142,"publishedAt":40},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[133,136,137],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":138,"categoryName":139,"taxonomyType":140,"taxonomyTypeDesc":141},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[143,122,144,145,146,119,36,147,120,121,30,148,149,24,150,151,32,33,152,38],"api security posture","api","api security","security posture","broken","broken authentication","t1078","api-security","authentication","next",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":40},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[159],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[161,162,163,164,165,38,166,167,32,119,168,121,30,169,170,171,172,122,173,174],"os hardening","os","hardening","diff","git","benchmarks","engineer","system","endpoint","false","assessment","windows","linux","macos",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":182,"publishedAt":40},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[181],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[183,184,185,117,186,187,188,189,30,38,190,191],"risk threat modeling","modeling","threat","threat modeling","stride","threat-modeling","governance","model","prioritize",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":40},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[198],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[200,201,202,38,203,204,30,117,205,206],"regulatory horizon","regulatory","monitor","intelligence","board","privacy","cybersecurity",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":40},"01M6D85FZJDT267K3RFN06CJK3","quantum-security-readiness","USAP agent skill for Quantum Security Readiness. Use for Track post-quantum migration readiness and crypto agility.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fquantum-security-readiness\u002FSKILL.md",[213],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[122,215,216,38,217,218,32,30,219,189],"quantum","quantum security readiness","crypto","migration","post-quantum"]