Description
owasp-top-10-testing is a Strix skill for testing an application against the OWASP Top 10. The OWASP Top 10 is a list of risk categories rather than a test suite, so the skill runs the agents against each category on the real application and reports what can actually be exploited. It is explicit that claiming a clean sweep of all ten categories would be misleading, and it tells the user what can and cannot be tested by an agent. The skill uses the current edition, OWASP Top 10:2025, and asks before it targets an older edition, since some compliance checklists still reference 2021 and a report with the wrong edition label is misleading. It lists the main differences from 2021: SSRF is folded into A01, the old outdated-components category has become software supply chain failures at A03, a new category for mishandling exceptional conditions is at A10, and security misconfiguration has moved up to A02. Strix's agents do the exploitation, and the skill covers running the scan category by category and reporting coverage honestly. For installation and the managed cloud route, it points to the penetration-testing-with-strix skill. It is for security teams and developers who need a category-by-category result for a report. It passes Gen Agent Trust Hub and Snyk on skills.sh, and Socket shows a warning. It has about 10,200 installs. Install it with npx skills add https://github.com/usestrix/strix --skill owasp-top-10-testing.…
Highlights
- Tests each OWASP Top 10:2025 category on the real application
- Reports coverage honestly, with no false clean sweep
- Asks before using an older edition such as 2021
- Lists what an agent can and cannot test
Ratings & Reviews
No ratings yet
Be the first to rate owasp-top-10-testing.
People also visit
application-security-testing
Application security testing (AppSec) across a whole product with Strix
fix-security-vulnerabilities-with-strix
Fix security vulnerabilities found by a Strix pentest
penetration-testing-with-strix
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix
owasp-top-10-testing FAQ
Which OWASP edition does it use?
OWASP Top 10:2025, and it asks before targeting an older edition.
Does a pass mean the app is secure?
No. The skill is explicit that a clean sweep of all ten categories would be misleading, and it reports what is actually exploitable.
What changed from 2021?
SSRF is folded into A01, supply chain failures expand the old components category at A03, A10 is new, and misconfiguration moved to A02.
How do I install it?
Run npx skills add https://github.com/usestrix/strix --skill owasp-top-10-testing.
What are the best owasp-top-10-testing alternatives?
Popular alternatives to owasp-top-10-testing include api-security-testing, application-security-testing and fix-security-vulnerabilities-with-strix. See all owasp-top-10-testing alternatives