Owasp Cicd

microsoft/owasp-cicd

OWASP CI/CD Top 10 knowledge base for identifying, assessing, and remediating CI/CD pipeline security risks.

17k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

1313

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/microsoft/hve-core --skill owasp-cicd

What comes with it

64 589 bytes besides the instruction

references/00-vulnerability-index.md

references/01-insufficient-flow-control-mechanisms.md

references/02-inadequate-identity-access-management.md

references/03-dependency-chain-abuse.md

references/04-poisoned-pipeline-execution.md

references/05-insufficient-pbac.md

references/06-insufficient-credential-hygiene.md

references/07-insecure-system-configuration.md

references/08-ungoverned-usage-of-3rd-party-services.md

references/09-improper-artifact-integrity-validation.md

references/10-insufficient-logging-visibility.md

The instruction itself

4 sections, as written by the author

OWASP® CI/CD Top 10 — Skill Entry

This SKILL.md is the entrypoint for the OWASP CI/CD Top 10 skill.

The skill encodes the OWASP Top 10 CI/CD Security Risks as structured, machine-readable references

that an agent can query to identify, assess, and remediate CI/CD pipeline security risks.

Normative references (CI/CD Top 10)

00 Vulnerability Index
01 Insufficient Flow Control Mechanisms
02 Inadequate Identity and Access Management
03 Dependency Chain Abuse
04 Poisoned Pipeline Execution
05 Insufficient PBAC
06 Insufficient Credential Hygiene
07 Insecure System Configuration
08 Ungoverned Usage of 3rd Party Services

10. 09 Improper Artifact Integrity Validation

11. 10 Insufficient Logging and Visibility

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — the CI/CD Top 10 normative documents.
00-vulnerability-index.md — index of all vulnerability identifiers, categories, and cross-references.
01 through 10 — one document per vulnerability aligned with OWASP CI/CD Security numbering.

Third-Party Attribution

OWASP® Top 10 CI/CD Security Risks content is derived from works by the

OWASP Foundation, licensed under CC BY-SA 4.0

(<https://creativecommons.org/licenses/by-sa/4.0/>).

Source: <https://owasp.org/www-project-top-10-ci-cd-security-risks/>

Modifications: Vulnerability descriptions restructured into agent-consumable reference

documents with added detection and remediation guidance.

OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.

How to use it

Copy the folder

Take microsoft/owasp-cicd from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.