Summary

Create the owasp-infrastructure skill under owasp-infrastructure providing detection checklists, severity guidance, and remediation patterns for the OWASP Infrastructure Security Top 10 (2024) vulnerabilities.

This skill is consumed by the security-reviewer agent (not user-invocable). Content is adapted from JasonTheDeveloper's owasp-skills infrastructure-vulnerabilities skill with hve-core naming and conventions applied.

Acceptance Criteria

• SKILL.md exists with valid frontmatter

  • name: owasp-infrastructure matches directory name
  • description ends with - Brought to you by microsoft/hve-core
  • user-invocable: false
  • metadata.content_based_on references OWASP Infrastructure Top 10 source URL

• references/ directory contains 11 files:

  • 00-vulnerability-index.md — summary table with all 10 vulnerabilities
  • 01-outdated-software.md
  • 02-insufficient-threat-detection.md
  • 03-insecure-configurations.md
  • 04-insecure-resource-user-management.md
  • 05-insecure-use-of-cryptography.md
  • 06-insecure-network-access-management.md
  • 07-insecure-authentication-default-credentials.md
  • 08-information-leakage.md
  • 09-insecure-access-resources-management-components.md
  • 10-insufficient-asset-management-documentation.md

• Each reference file follows the 7-section pattern: Description → Risk → Vulnerability Checklist → Prevention Controls → Example Attacks → Detection Guidance → Remediation

• SKILL.md body references the vulnerability index and instructs the agent on how to traverse references

• npm run validate:skills passes for this skill

Content Source

Adapted from JasonTheDeveloper's owasp-skills infrastructure-vulnerabilities/ skill. Naming convention changed from infrastructure-vulnerabilities to owasp-infrastructure per Discussion #480 terminology alignment.

File Structure

.github/skills/security/owasp-infrastructure/
├── SKILL.md
└── references/
    ├── 00-vulnerability-index.md
    ├── 01-outdated-software.md
    ├── 02-insufficient-threat-detection.md
    ├── 03-insecure-configurations.md
    ├── 04-insecure-resource-user-management.md
    ├── 05-insecure-use-of-cryptography.md
    ├── 06-insecure-network-access-management.md
    ├── 07-insecure-authentication-default-credentials.md
    ├── 08-information-leakage.md
    ├── 09-insecure-access-resources-management-components.md
    └── 10-insufficient-asset-management-documentation.md