Owasp Infrastructure
MicrosoftOfficialPublished by Microsoft
- Skill
- Guidelines
- Security
- CC-BY-SA-4.0
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The OWASP Infrastructure Top 10 skill provides a machine-readable reference for the 2024 OWASP Infrastructure Security Top 10. It is designed to assist agents in evaluating internal IT infrastructure against common security risks. Each of the ten identified vulnerabilities is documented with a standardized structure, including descriptions, risk assessments, checklists, prevention controls, attack scenarios, detection guidance, and remediation steps.
What it does
- Provides structured access to the OWASP Infrastructure Security Top 10 (2024) vulnerabilities.
- Offers checklists to identify potential security exposures in internal infrastructure.
- Outlines specific prevention controls and defensive measures for each risk category.
- Includes realistic attack scenarios to illustrate how vulnerabilities are exploited.
- Provides actionable detection guidance and remediation steps for security teams.
- Categorizes infrastructure risks into areas like patch management, access control, and data protection.
When to use it
- When performing a security audit of internal IT infrastructure.
- When establishing or improving an infrastructure security management process.
- When assessing the risk profile of existing software and system configurations.
- When training teams on common infrastructure security vulnerabilities and mitigation strategies.
Advantages
- Standardized format allows for consistent evaluation of security risks.
- Derived from authoritative OWASP Foundation content.
- Provides both high-level guidance and specific remediation actions.
- Covers a broad spectrum of infrastructure concerns from credential hygiene to asset management.
Usage examples
- “What are the risks associated with outdated software in our infrastructure?”
- The agent retrieves the ISR01:2024 reference, detailing risks like system compromise, lack of vendor support, and the ease of exploiting known vulnerabilities.
- “How can I detect insecure network access management?”
- The agent provides the detection guidance from the ISR06:2024 document, suggesting methods to identify misconfigured network access controls.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/owasp-infrastructure/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip owasp-infrastructure.zip -d .agents/skills
Documentation by Microsoft
OWASP® Infrastructure Top 10 — Skill Entry
This SKILL.md is the entrypoint for the OWASP Infrastructure Top 10 skill.
The skill encodes the OWASP Infrastructure Security Top 10 (2024) as structured, machine-readable references that an agent can query to identify, assess, and remediate infrastructure security risks.
Normative references (Infrastructure Top 10)
Skill layout
SKILL.md— this file (skill entrypoint).references/— the Infrastructure Top 10 normative documents.00-vulnerability-index.md— index of all vulnerability identifiers, categories, and cross-references.01through10— one document per vulnerability aligned with OWASP Infrastructure Security numbering.
Third-Party Attribution
Copyright © OWASP Foundation. OWASP® Infrastructure Security Top 10 content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://owasp.org/www-project-top-10-infrastructure-security-risks/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.
Files
- ATTRIBUTION.mdAdded by AutoGineer995 B
- LICENSEAdded by AutoGineer17.9 KiB
- SKILL.md2.8 KiB
- references/00-vulnerability-index.md2.8 KiB
- references/01-outdated-software.md3.8 KiB
- references/02-insufficient-threat-detection.md4.5 KiB
- references/03-insecure-configurations.md3.9 KiB
- references/04-insecure-resource-user-management.md4.7 KiB
- references/05-insecure-use-of-cryptography.md4.6 KiB
- references/06-insecure-network-access-management.md4.6 KiB
- references/07-insecure-authentication-default-credentials.md3.7 KiB
- references/08-information-leakage.md3.9 KiB
- references/09-insecure-access-resources-management-components.md4.5 KiB
- references/10-insufficient-asset-management-documentation.md4.5 KiB
references/00-vulnerability-index.md
title: 'OWASP Infrastructure Top 10 Vulnerability Index' description: Index of OWASP Infrastructure Security Top 10 (2024) vulnerability identifiers, categories, and cross-references
00 Vulnerability Index
This document provides the index for the OWASP Infrastructure Security Top 10 (2024) vulnerabilities. Each entry includes its identifier, title, and primary category.
Vulnerability catalog
| ID | Title | Category |
|---|---|---|
| ISR01:2024 | Outdated Software | Patch Management |
| ISR02:2024 | Insufficient Threat Detection | Observability |
| ISR03:2024 | Insecure Configurations | Configuration Management |
| ISR04:2024 | Insecure Resource and User Management | Access Control |
| ISR05:2024 | Insecure Use of Cryptography | Data Protection |
| ISR06:2024 | Insecure Network Access Management | Network Security |
| ISR07:2024 | Insecure Authentication Methods and Default Credentials | Credential Hygiene |
| ISR08:2024 | Information Leakage | Data Protection |
| ISR09:2024 | Insecure Access to Resources and Management Components | Access Control |
| ISR10:2024 | Insufficient Asset Management and Documentation | Governance |
Cross-reference matrix
Each vulnerability document follows a consistent structure:
Description — what the vulnerability is and how it manifests in internal infrastructure.
Risk — concrete consequences of exploitation and business impact.
Vulnerability checklist — indicators that the environment is exposed.
Prevention controls — defensive measures and rectification steps.
Example attack scenarios — realistic exploitation narratives.
Detection guidance — signals and methods to identify exposure.
Remediation — immediate and long-term actions to contain and resolve.
Category groupings
Patch Management
ISR01:2024 Outdated Software
Observability
ISR02:2024 Insufficient Threat Detection
Configuration Management
ISR03:2024 Insecure Configurations
Access Control
ISR04:2024 Insecure Resource and User Management
ISR09:2024 Insecure Access to Resources and Management Components
Data Protection
ISR05:2024 Insecure Use of Cryptography
ISR08:2024 Information Leakage
Network Security
ISR06:2024 Insecure Network Access Management
Credential Hygiene
ISR07:2024 Insecure Authentication Methods and Default Credentials
Governance
ISR10:2024 Insufficient Asset Management and Documentation
Requirements and compatibility
Written for: GitHub Copilot, Claude Code
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Claude Code frontmatter
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/hve-core · .github/skills/security/owasp-infrastructure · commit f425e94
- Licence
- Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
- LICENSE (written by AutoGineer)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download owasp-infrastructure.zip