AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides a machine-readable implementation of the OWASP Top 10 for Web Applications (2025). It serves as a comprehensive reference for developers and security professionals to understand, detect, and mitigate critical web vulnerabilities. Each of the ten vulnerability categories is documented with detailed descriptions, risk assessments, checklists for identifying exposure, and actionable prevention controls.
What it does
- Provides structured access to the 2025 OWASP Top 10 web security vulnerabilities.
- Offers vulnerability-specific checklists to help identify potential security gaps.
- Includes detailed prevention controls and remediation strategies for each risk.
- Supplies clear descriptions of how vulnerabilities manifest in modern web applications.
- Categorizes risks by their primary security domain, such as Access Control or Cryptography.
- Enables agents to perform security-focused analysis and provide guidance on hardening applications.
When to use it
- During the design phase to ensure security best practices are built into the architecture.
- When performing security audits or code reviews to identify common vulnerability patterns.
- When remediating specific security findings reported by automated scanners or penetration tests.
- To educate development teams on the most critical risks facing web applications today.
Advantages
- Standardized, machine-readable format allows for easy integration into agent workflows.
- Covers the most critical and pervasive web application security risks.
- Provides actionable, concrete steps for both detection and long-term remediation.
- Aligned with the industry-standard OWASP framework for consistency in security reporting.
Usage examples
- “What are the common indicators that my application is vulnerable to broken access control?”
- The agent will return a checklist of indicators, such as the ability to bypass access controls via URL tampering or missing authorization on API endpoints.
- “How can I prevent cryptographic failures in my web application?”
- The agent will provide specific prevention controls, such as enforcing strong encryption standards and managing keys securely.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/owasp-top-10/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip owasp-top-10.zip -d .agents/skills
Documentation by Microsoft
OWASP® Top 10 — Skill Entry
This SKILL.md is the entrypoint for the OWASP Top 10 skill.
The skill encodes the OWASP Top 10 for Web Applications (2025) as structured, machine-readable references that an agent can query to identify, assess, and remediate web application security risks.
Normative references (Web Top 10)
Skill layout
SKILL.md— this file (skill entrypoint).references/— the Web Top 10 normative documents.00-vulnerability-index.md— index of all vulnerability identifiers, categories, and cross-references.01through10— one document per vulnerability aligned with OWASP Web Application Security numbering.
Third-Party Attribution
Copyright © OWASP Foundation. OWASP® Top 10 (2025) content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://owasp.org/Top10/2025/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.
Files
- ATTRIBUTION.mdAdded by AutoGineer979 B
- LICENSEAdded by AutoGineer17.9 KiB
- SKILL.md2.5 KiB
- references/00-vulnerability-index.md2.8 KiB
- references/01-broken-access-control.md5.9 KiB
- references/02-security-misconfiguration.md5.7 KiB
- references/03-software-supply-chain-failures.md6.1 KiB
- references/04-cryptographic-failures.md5.9 KiB
- references/05-injection.md5.6 KiB
- references/06-insecure-design.md5.6 KiB
- references/07-authentication-failures.md5.8 KiB
- references/08-software-data-integrity-failures.md5.7 KiB
- references/09-security-logging-alerting-failures.md5.9 KiB
- references/10-mishandling-exceptional-conditions.md6.2 KiB
references/00-vulnerability-index.md
title: OWASP Web Top 10 Vulnerability Index description: Index of OWASP Web Application Security Top 10 vulnerability identifiers, categories, and cross-references
00 Vulnerability Index
This document provides the index for the OWASP Web Application Security Top 10 vulnerabilities. Each entry includes its identifier, title, and primary category.
Vulnerability catalog
| ID | Title | Category |
|---|---|---|
| A01:2025 | Broken Access Control | Access Control |
| A02:2025 | Security Misconfiguration | Configuration Management |
| A03:2025 | Software Supply Chain Failures | Supply Chain |
| A04:2025 | Cryptographic Failures | Cryptography |
| A05:2025 | Injection | Input Validation |
| A06:2025 | Insecure Design | Architecture and Design |
| A07:2025 | Authentication Failures | Authentication |
| A08:2025 | Software or Data Integrity Failures | Data Integrity |
| A09:2025 | Security Logging and Alerting Failures | Logging and Monitoring |
| A10:2025 | Mishandling of Exceptional Conditions | Error Handling |
Cross-reference matrix
Each vulnerability document follows a consistent structure:
Description — what the vulnerability is and how it manifests in web applications.
Risk — concrete consequences of exploitation and business impact.
Vulnerability checklist — indicators that the application is exposed.
Prevention controls — defensive measures and rectification steps.
Example attack scenarios — realistic exploitation narratives.
Detection guidance — signals and methods to identify exposure.
Remediation — immediate and long-term actions to contain and resolve.
Category groupings
Access Control
A01:2025 Broken Access Control
Configuration Management
A02:2025 Security Misconfiguration
Supply Chain
A03:2025 Software Supply Chain Failures
Cryptography
A04:2025 Cryptographic Failures
Input Validation
A05:2025 Injection
Architecture and Design
A06:2025 Insecure Design
Authentication
A07:2025 Authentication Failures
Data Integrity
A08:2025 Software or Data Integrity Failures
Logging and Monitoring
A09:2025 Security Logging and Alerting Failures
Error Handling
A10:2025 Mishandling of Exceptional Conditions
Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Modifications: Restructured into agent-consumable reference format with added detection and remediation guidance.
Requirements and compatibility
Written for: GitHub Copilot, Claude Code
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Claude Code frontmatter
Security
What our scanner noticed· Low risk
- Instructions that use the network
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/hve-core · .github/skills/security/owasp-top-10 · commit f425e94
- Licence
- Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
- LICENSE (written by AutoGineer)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download owasp-top-10.zip