Mapping Findings To Owasp Top10

What it does

When your agent uses it

• : enriching findings after cluster 1-4 scans
• Regenerating the report with OWASP tags
• Producing the OWASP coverage section for an exec summary
• Auditing engagement OWASP coverage

Example prompts

• “map to OWASP”
• “owasp top 10 mapping”
• “annotate owasp categories”
• “/mapping-findings-to-owasp-top10”

Requirements

• Python 3
• Compatibility (from SKILL.md): Designed for Claude Code
• Pre-approved tools (allowed-tools): Read, Write, Bash(python3:*), Glob

Workflow steps

4 steps, taken from the step headings in SKILL.md.

1. 1Identify findings sources
2. 2Run the mapper
3. 3Review unmapped findings
4. 4Read the coverage report

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Write
  • Bash(python3:*)
  • Glob

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python), which the agent can run.

  Shell commands in SKILL.md call:

  • python3

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Designed for Claude Code

  From compatibility in the SKILL.md frontmatter.

Context cost

Mapping Findings To Owasp Top10 loads about 2.1k tokens when it runs, and up to ~5.5k if it reads all its reference files. Until then it costs about 218 tokens; SKILL.md has 692 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~218

When it runs · the whole SKILL.md, loaded when a task matches

~2.1k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~5.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:27

  - Write(.env)

• NoteMentions a .env fileSKILL.md:28

  - Edit(.env)

• NoteMentions a .env fileSKILL.md:178

  detail_contains: ".env"

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 692 words, ~2,074 tokens.

name

mapping-findings-to-owasp-top10

description

Annotate every pentest finding with its OWASP Top 10 (2021) category by applying a deterministic rule table keyed on source skill, finding category, detail keywords, and CWE identifier when present. Produces an enriched findings JSONL plus a per-category rollup report showing how findings distribute across A01 through A10. Required for customer-facing OWASP coverage sections and compliance contexts (PCI DSS 6.5, SOC2 CC7, ISO 27001 A.14.2). Use when: enriching findings after cluster 1-4 scans, regenerating the report with OWASP tags, producing the OWASP coverage section for an exec summary, or auditing engagement OWASP coverage. Threshold: unclassifiable findings emitted as INFO with UNMAPPED category for operator review. Trigger with: "map to OWASP", "owasp top 10 mapping", "annotate owasp categories", "owasp coverage check".

allowed-tools

Read, Write, Bash(python3:*), Glob

compatibility

Designed for Claude Code

disallowed-tools

Bash(rm:*), Bash(curl:*), Bash(wget:*), Write(.env), Edit(.env)

version

3.30.0

author

Jeremy Longshore <jeremy@intentsolutions.io>

license

MIT

tags

security, reporting, owasp, top10, pentest

python3 ./scripts/map_owasp.py engagements/acme-2026-q2/

Usage: map_owasp.py PATH [OPTIONS]

Options:
  --source FILE           Specific findings file (repeatable)
  --enrich-output FILE    Write annotated findings JSONL here
                          (default: PATH/findings/all-with-owasp.jsonl)
  --coverage-output FILE  Coverage report path
                          (default: PATH/reports/owasp-coverage.md)
  --overrides FILE        Optional rule-overrides YAML
  --output FILE           Operational findings output
  --format FMT            json | jsonl | markdown (default: markdown)
  --min-severity SEV      default info

python3 ./scripts/map_owasp.py engagements/acme-2026-q2/

# .owasp-overrides.yaml — engagement-specific classifications
- skill_id: auditing-cors-policy
  owasp_category: A05:2021 — Security Misconfiguration
  reason: customer treats CORS as misconfig, not access-control
- skill_id: scanning-for-hardcoded-secrets
  detail_contains: ".env"
  owasp_category: A02:2021 — Cryptographic Failures
  reason: env-file leaks treated as crypto failure for this engagement

python3 ./scripts/map_owasp.py engagements/acme-2026-q2/ \
    --overrides engagements/acme-2026-q2/.owasp-overrides.yaml

python3 ./scripts/map_owasp.py engagements/acme-2026-q2/ \
    --enrich-output /dev/null \
    --coverage-output /tmp/coverage.md

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/.curated/mapping-findings-to-owasp-top10 of jeremylongshore/tons-of-skills-marketplace.

• SKILL.md
• references/PLAYBOOK.md
• references/THEORY.md
• scripts/map_owasp.py

Open the folder on GitHubat commit cfae287