Owasp Top 10

microsoft/owasp-top-10

OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks.

16k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

1313

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/microsoft/hve-core --skill owasp-top-10

What comes with it

62 611 bytes besides the instruction

references/00-vulnerability-index.md

references/01-broken-access-control.md

references/02-security-misconfiguration.md

references/03-software-supply-chain-failures.md

references/04-cryptographic-failures.md

references/05-injection.md

references/06-insecure-design.md

references/07-authentication-failures.md

references/08-software-data-integrity-failures.md

references/09-security-logging-alerting-failures.md

references/10-mishandling-exceptional-conditions.md

The instruction itself

4 sections, as written by the author

OWASP® Top 10 — Skill Entry

This SKILL.md is the entrypoint for the OWASP Top 10 skill.

The skill encodes the OWASP Top 10 for Web Applications (2025) as structured, machine-readable

references that an agent can query to identify, assess, and remediate web application security

risks.

Normative references (Web Top 10)

00 Vulnerability Index
01 Broken Access Control
02 Security Misconfiguration
03 Software Supply Chain Failures
04 Cryptographic Failures
05 Injection
06 Insecure Design
07 Authentication Failures
08 Software or Data Integrity Failures

10. 09 Security Logging and Alerting Failures

11. 10 Mishandling of Exceptional Conditions

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — the Web Top 10 normative documents.
00-vulnerability-index.md — index of all vulnerability identifiers, categories, and cross-references.
01 through 10 — one document per vulnerability aligned with OWASP Web Application Security numbering.

Third-Party Attribution

OWASP® Top 10 (2025) content is derived from works by the OWASP Foundation, licensed

under CC BY-SA 4.0 (<https://creativecommons.org/licenses/by-sa/4.0/>).

Source: <https://owasp.org/Top10/2025/>

Modifications: Vulnerability descriptions restructured into agent-consumable reference

documents with added detection and remediation guidance.

OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.

How to use it

Copy the folder

Take microsoft/owasp-top-10 from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.