AutoGineer
Generated banner for Owasp Infrastructure
Generated logo for Owasp Infrastructure

Owasp Infrastructure

MicrosoftOfficialPublished by Microsoft

  • Skill
  • Guidelines
  • Security
  • CC-BY-SA-4.0
  • No issues found
Download ZIP

From the author

OWASP Infrastructure Top 10 knowledge base for identifying, assessing, and remediating internal IT infrastructure security risks.
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The OWASP Infrastructure Top 10 skill provides a machine-readable reference for the 2024 OWASP Infrastructure Security Top 10. It is designed to assist agents in evaluating internal IT infrastructure against common security risks. Each of the ten identified vulnerabilities is documented with a standardized structure, including descriptions, risk assessments, checklists, prevention controls, attack scenarios, detection guidance, and remediation steps.

What it does

  • Provides structured access to the OWASP Infrastructure Security Top 10 (2024) vulnerabilities.
  • Offers checklists to identify potential security exposures in internal infrastructure.
  • Outlines specific prevention controls and defensive measures for each risk category.
  • Includes realistic attack scenarios to illustrate how vulnerabilities are exploited.
  • Provides actionable detection guidance and remediation steps for security teams.
  • Categorizes infrastructure risks into areas like patch management, access control, and data protection.

When to use it

  • When performing a security audit of internal IT infrastructure.
  • When establishing or improving an infrastructure security management process.
  • When assessing the risk profile of existing software and system configurations.
  • When training teams on common infrastructure security vulnerabilities and mitigation strategies.

Advantages

  • Standardized format allows for consistent evaluation of security risks.
  • Derived from authoritative OWASP Foundation content.
  • Provides both high-level guidance and specific remediation actions.
  • Covers a broad spectrum of infrastructure concerns from credential hygiene to asset management.

Usage examples

“What are the risks associated with outdated software in our infrastructure?”
The agent retrieves the ISR01:2024 reference, detailing risks like system compromise, lack of vendor support, and the ease of exploiting known vulnerabilities.
“How can I detect insecure network access management?”
The agent provides the detection guidance from the ISR06:2024 document, suggesting methods to identify misconfigured network access controls.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/microsoft/owasp-infrastructure/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip owasp-infrastructure.zip -d .agents/skills

Documentation by Microsoft

OWASP® Infrastructure Top 10 — Skill Entry

This SKILL.md is the entrypoint for the OWASP Infrastructure Top 10 skill.

The skill encodes the OWASP Infrastructure Security Top 10 (2024) as structured, machine-readable references that an agent can query to identify, assess, and remediate infrastructure security risks.

Normative references (Infrastructure Top 10)

  1. 00 Vulnerability Index

  2. 01 Outdated Software

  3. 02 Insufficient Threat Detection

  4. 03 Insecure Configurations

  5. 04 Insecure Resource and User Management

  6. 05 Insecure Use of Cryptography

  7. 06 Insecure Network Access Management

  8. 07 Insecure Authentication Methods and Default Credentials

  9. 08 Information Leakage

  10. 09 Insecure Access to Resources and Management Components

  11. 10 Insufficient Asset Management and Documentation

Skill layout

  • SKILL.md — this file (skill entrypoint).

  • references/ — the Infrastructure Top 10 normative documents.

    • 00-vulnerability-index.md — index of all vulnerability identifiers, categories, and cross-references.

    • 01 through 10 — one document per vulnerability aligned with OWASP Infrastructure Security numbering.

Third-Party Attribution

Copyright © OWASP Foundation. OWASP® Infrastructure Security Top 10 content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://owasp.org/www-project-top-10-infrastructure-security-risks/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.

Files

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/hve-core · .github/skills/security/owasp-infrastructure · commit f425e94
Licence
Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
  • LICENSE (written by AutoGineer)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download owasp-infrastructure.zip