Skip to content

[REVIEW] owasp-top-10-web: add 2025 'AI-Integrated Web App' vectors and API-First 'A11' checks #1465

@sosal123tyu1

Description

@sosal123tyu1

Skill Being Reviewed

Skill name: owasp-top-10-web
Skill path: skills/appsec/owasp-top-10-web/

False Positive Analysis

Scenario: A03:2021-Injection (XSS).
Observation: The skill flags innerHTML usage as a "Critical" vulnerability regardless of context.
Why this is a false positive: In modern Sanitized React/Vue environments or when using the Sanitizer API (native in browsers 2024+), innerHTML can be used safely.
Recommendation: The skill should check for the presence of a "Sanitization Policy" (Trusted Types) before flagging innerHTML as a finding.

Coverage Gaps

1. AI-Integrated Web App Vectors (A11):
In 2025/2026, most web apps use LLMs. The skill misses "Client-Side Prompt Injection" and "AI-Generated Content XSS". If the web app renders model output without sanitization, it's a new class of XSS.
2. API-First Authentication (A07):
The skill is very "Cookie/Session" focused. It misses modern Passkeys (WebAuthn) and OAuth2 DPoP (Demonstrating Proof-of-Possession) which are the 2025 standard for preventing token theft.
3. Server-Side Request Forgery (A10) - Cloud Metadata Gaps:
SSRF checks should specifically look for IMDSv2 enforcement (AWS) and the "Metadata-Flavor: Google" header (GCP). The current checks are too generic.

Remediation Quality

  • Fix resolves the vulnerability
  • Fix doesn't introduce new security issues
  • Fix doesn't break functionality
    Issues found: The remediation recommendations should point to the OWASP ASVS 5.0 (published 2024/2025) as the verification standard. Top 10 is for awareness; ASVS is for actual implementation.

Overall Assessment

A solid operationalization of the Top 10. To stay relevant in 2026, it MUST address the security of the "AI features" integrated into the web front-ends.

Bounty Info

  • I have read and agree to the CONTRIBUTING.md bounty terms
  • Preferred payment method: Crypto (USDT TRC-20) to TShez1CVHVmjcffwkhRjKJfxkXnKxrZFcc

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions