AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The owasp-cicd skill provides a machine-readable reference library derived from the OWASP Top 10 CI/CD Security Risks project. It is designed to assist AI agents in evaluating pipeline security by offering standardized definitions, risk assessments, and remediation strategies for common vulnerabilities such as dependency chain abuse, insufficient flow control, and inadequate identity management. Each vulnerability is documented with specific checklists, attack scenarios, and defensive controls to support security auditing and hardening of CI/CD environments.
What it does
- Provides structured documentation for the 10 most critical CI/CD security risks.
- Offers vulnerability checklists to identify potential exposure in pipeline configurations.
- Details specific prevention controls and remediation steps for each risk category.
- Includes realistic attack scenarios to help visualize potential exploitation paths.
- Supplies detection guidance to help identify security signals within CI/CD systems.
When to use it
- When auditing CI/CD pipeline configurations for security gaps.
- When developing security policies for automated build and deployment processes.
- When assessing the risk profile of existing supply chain and deployment workflows.
- When training or prompting an agent to perform security reviews of infrastructure-as-code or pipeline definitions.
Advantages
- Standardized, machine-readable format facilitates integration into automated security workflows.
- Derived from the authoritative OWASP CI/CD Security project.
- Covers both immediate remediation and long-term defensive strategies.
- Provides clear, actionable guidance for complex security topics like artifact integrity and credential hygiene.
Usage examples
- “What are the risks associated with insufficient flow control in our CI/CD pipeline?”
- The agent retrieves the CICD-SEC-1 reference, outlining risks like unauthorized code pushes and deployment bypasses, and provides a checklist to verify branch protection rules.
- “How can we prevent dependency chain abuse in our build process?”
- The agent accesses the CICD-SEC-3 documentation to provide specific prevention controls and detection methods for securing the software supply chain.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/owasp-cicd/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip owasp-cicd.zip -d .agents/skills
Documentation by Microsoft
OWASP® CI/CD Top 10 — Skill Entry
This SKILL.md is the entrypoint for the OWASP CI/CD Top 10 skill.
The skill encodes the OWASP Top 10 CI/CD Security Risks as structured, machine-readable references that an agent can query to identify, assess, and remediate CI/CD pipeline security risks.
Normative references (CI/CD Top 10)
Skill layout
SKILL.md— this file (skill entrypoint).references/— the CI/CD Top 10 normative documents.00-vulnerability-index.md— index of all vulnerability identifiers, categories, and cross-references.01through10— one document per vulnerability aligned with OWASP CI/CD Security numbering.
Third-Party Attribution
Copyright © OWASP Foundation. OWASP® Top 10 CI/CD Security Risks content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://owasp.org/www-project-top-10-ci-cd-security-risks/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.
Files
- ATTRIBUTION.mdAdded by AutoGineer975 B
- LICENSEAdded by AutoGineer17.9 KiB
- SKILL.md2.6 KiB
- references/00-vulnerability-index.md2.8 KiB
- references/01-insufficient-flow-control-mechanisms.md5.2 KiB
- references/02-inadequate-identity-access-management.md6.0 KiB
- references/03-dependency-chain-abuse.md5.9 KiB
- references/04-poisoned-pipeline-execution.md6.9 KiB
- references/05-insufficient-pbac.md5.6 KiB
- references/06-insufficient-credential-hygiene.md6.1 KiB
- references/07-insecure-system-configuration.md5.9 KiB
- references/08-ungoverned-usage-of-3rd-party-services.md6.5 KiB
- references/09-improper-artifact-integrity-validation.md5.7 KiB
- references/10-insufficient-logging-visibility.md6.5 KiB
references/00-vulnerability-index.md
title: OWASP CI/CD Top 10 Vulnerability Index description: Index of OWASP Top 10 CI/CD Security Risks (2025) vulnerability identifiers, categories, and cross-references
00 Vulnerability Index
This document provides the index for the OWASP CI/CD Security Top 10 vulnerabilities. Each entry includes its identifier, title, and primary category.
Vulnerability catalog
| ID | Title | Category |
|---|---|---|
| CICD-SEC-1:2025 | Insufficient Flow Control Mechanisms | Flow Control |
| CICD-SEC-2:2025 | Inadequate Identity and Access Management | Identity Management |
| CICD-SEC-3:2025 | Dependency Chain Abuse | Supply Chain |
| CICD-SEC-4:2025 | Poisoned Pipeline Execution | Pipeline Security |
| CICD-SEC-5:2025 | Insufficient PBAC | Access Controls |
| CICD-SEC-6:2025 | Insufficient Credential Hygiene | Credential Management |
| CICD-SEC-7:2025 | Insecure System Configuration | Configuration Management |
| CICD-SEC-8:2025 | Ungoverned Usage of 3rd Party Services | Third-Party Governance |
| CICD-SEC-9:2025 | Improper Artifact Integrity Validation | Artifact Integrity |
| CICD-SEC-10:2025 | Insufficient Logging and Visibility | Logging and Visibility |
Cross-reference matrix
Each vulnerability document follows a consistent structure:
Description — what the vulnerability is and how it manifests in CI/CD environments.
Risk — concrete consequences of exploitation and business impact.
Vulnerability checklist — indicators that the environment is exposed.
Prevention controls — defensive measures and rectification steps.
Example attack scenarios — realistic exploitation narratives.
Detection guidance — signals and methods to identify exposure.
Remediation — immediate and long-term actions to contain and resolve.
Category groupings
Flow Control
CICD-SEC-1:2025 Insufficient Flow Control Mechanisms
Identity Management
CICD-SEC-2:2025 Inadequate Identity and Access Management
Supply Chain
CICD-SEC-3:2025 Dependency Chain Abuse
Pipeline Security
CICD-SEC-4:2025 Poisoned Pipeline Execution
Access Controls
CICD-SEC-5:2025 Insufficient PBAC
Credential Management
CICD-SEC-6:2025 Insufficient Credential Hygiene
Configuration Management
CICD-SEC-7:2025 Insecure System Configuration
Third-Party Governance
CICD-SEC-8:2025 Ungoverned Usage of 3rd Party Services
Artifact Integrity
CICD-SEC-9:2025 Improper Artifact Integrity Validation
Logging and Visibility
CICD-SEC-10:2025 Insufficient Logging and Visibility
Requirements and compatibility
Written for: GitHub Copilot, Claude Code
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Claude Code frontmatter
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/hve-core · .github/skills/security/owasp-cicd · commit f425e94
- Licence
- Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
- LICENSE (written by AutoGineer)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download owasp-cicd.zip