security-requirements
Skill0 starsChanged 12 days agoMITView on GitHub
Define verifiable application security requirements using OWASP ASVS 5.0 levels (and MASVS for mobile), mapped to the application's risk, and turn them into acceptance criteria, tests and review checklists. Use when starting a project, writing security acceptance criteria for features, selecting an assurance level, or auditing an application against ASVS.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
Security Requirements (ASVS)
Choose a level
| ASVS level | Use for |
| L1 | Low-risk apps; minimum baseline, largely testable externally |
| L2 | Most apps handling personal or business-sensitive data (default) |
| L3 | High-value apps: critical infrastructure, healthcare, finance, high-assurance identity |
ASVS 5.0 (released 2025) reorganized chapters (e.g., encoding and sanitization, validation and business logic, web frontend security, API and web service, file handling, authentication, session management, authorization, self-contained tokens, OAuth/OIDC, cryptography, secure communication, configuration, data protection, logging and error handling). Requirement IDs changed from 4.0.3 — cite the version.
For all 17 chapters with example acceptance criteria and verification methods, and mappings to the OWASP Top 10:2025, API Security Top 10 2023 and LLM Top 10 2025, read references/owasp-mappings.md.
Workflow
- Classify the app (data, users, exposure) → choose level.
- Select relevant chapters (skip N/A: e.g., no file upload) and record why.
- Convert each requirement into acceptance criteria for stories, e.g.:
- "Given a user requests
/orders/{id}for an order they don't own, the API returns 403/404 and logs an authorization failure." (authorization) - "Session cookies have
Secure,HttpOnly,SameSite=LaxorStrict." (session management)
- "Given a user requests
- Map each to verification: unit/integration test, SAST rule, DAST check, manual review, pen test.
- Track coverage per release; exceptions through risk acceptance.
Output
ASVS ID (v5.0) | Requirement (short) | Applies? | Acceptance criteria | Verification method | Status | Evidence
Related skills
threat-modeling, secure-code-review, mobile-app-security-review, release-gate
References
- OWASP ASVS: https://owasp.org/www-project-application-security-verification-standard/
- OWASP MASVS: https://mas.owasp.org/MASVS/
- NIST SP 800-218 Secure Software Development Framework (SSDF): https://csrc.nist.gov/pubs/sp/800/218/final
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.