feat(skill): introduce `owasp-docker` by JasonTheDeveloper · Pull Request #1245 · microsoft/hve-core

JasonTheDeveloper · 2026-03-31T04:21:00Z

Pull Request

Description

In alignment with phase 2 discussed in #480 (comment), this PR introduces the OWASP Docker Top 6 (not top 10 because the source material only contains 6 items) skill to hve-core and the security reviewer agent.

Related Issue(s)

Closes #1242

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)
Copilot skill (.github/skills/*/SKILL.md)

Note for AI Artifact Contributors:

Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.

Skills: Must include both bash and PowerShell scripts. See Skills.

Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.

See Agents Not Accepted and Model Version Requirements.

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Testing

To be able to test the owasp-docker skill using the security reviewer agent you will need a repository containing a Dockerfile.

Either select the Security Reviewer agent or invoke the agent via the /security-revew instruction
Use the following prompt analyse the code and produce a vulnerability report
- If you are testing to see if the codebase-profiler.agent.md picks up that the repository contains docker configurations and thus uses the owasp-docker skill then that's all you need.
- If you only want to test the owasp-docker is used, in your prompt add targetSkill=owasp-docker

You should see in the output report the owasp-docker skill being referenced and used.

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (if applicable)

AI Artifact Contributions

Used /prompt-analyze to review contribution
Addressed all feedback from prompt-builder review
Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Skill structure validation: npm run validate:skills
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps
Plugin freshness: npm run plugin:generate

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

…ker`

codecov-commenter · 2026-03-31T04:23:01Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.65%. Comparing base (77a8cfa) to head (7153707).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1245      +/-   ##
==========================================
- Coverage   87.66%   87.65%   -0.02%     
==========================================
  Files          61       61              
  Lines        9329     9329              
==========================================
- Hits         8178     8177       -1     
- Misses       1151     1152       +1

Flag	Coverage Δ
pester	`85.22% <ø> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…e-core`

JasonTheDeveloper · 2026-04-01T01:42:36Z

I ran the owasp-docker skill and here are the results:

OWASP Security Assessment Report

Date: 2026-04-01
Repository: hve-core
Agent: Security Reviewer
Skills applied: owasp-docker

Caution

This prompt is an assistive tool only and does not replace professional security tooling (SAST, DAST, SCA, penetration testing, compliance scanners) or qualified human review. All AI-generated vulnerability findings must be reviewed and validated by qualified security professionals before use. AI outputs may contain inaccuracies, miss critical threats, or produce recommendations that are incomplete or inappropriate for your environment.

Executive Summary

The OWASP Docker Top 6 assessment of hve-core evaluated six controls against the repository's devcontainer configuration. Two controls received PARTIAL status at LOW severity: DKR02 (floating base-image tag with no Dependabot docker ecosystem entry) was CONFIRMED, and DKR04 (missing runArgs hardening) was DOWNGRADED given the non-root user and development-only context. One control passed outright, and three were not assessable because the repository contains no production container deployments. Overall risk posture is acceptable for a documentation and tooling repository, with two defense-in-depth improvements recommended.

Summary Counts

Status	Count
PASS	1
FAIL	0
PARTIAL	2
NOT_ASSESSED	3
Total	6

Severity Breakdown (FAIL + PARTIAL only)

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM	0
LOW	2

Verification Summary

Verdict	Count
CONFIRMED	1
DISPROVED	0
DOWNGRADED	1
UNCHANGED	4

Findings by Framework

owasp-docker

ID	Title	Status	Severity	Location	Finding	Recommendation	Verdict	Justification
DKR02:2025	Patch Management Strategy	PARTIAL	LOW	.devcontainer/devcontainer.json#L3	The base image uses a floating tag `2-jammy` with no Dependabot docker ecosystem entry to automate updates.	Add a `devcontainers` ecosystem entry to `.github/dependabot.yml`; pin the default image to a digest.	CONFIRMED	Floating tag confirmed; no Dependabot docker entry exists. Enterprise override available but default is unpinned. Severity LOW — development container only.
DKR04:2025	Secure Defaults and Hardening	PARTIAL	LOW	.devcontainer/devcontainer.json#L1-L42	No `runArgs` with capability restrictions or `no-new-privileges` defined. Base image is a full Ubuntu distribution.	Add `--security-opt=no-new-privileges` to `runArgs`.	DOWNGRADED	Missing `runArgs` hardening confirmed. Non-root user, dev-only context, and SHA256-verified tool installs reduce exploitability. DKR04 primarily targets production containers.
DKR01:2025	Secure User Mapping	PASS	N/A	N/A	N/A	N/A	UNCHANGED	N/A
DKR03:2025	Network Segmentation and Firewalling	NOT_ASSESSED	N/A	N/A	N/A	N/A	UNCHANGED	N/A
DKR05:2025	Maintain Security Contexts	NOT_ASSESSED	N/A	N/A	N/A	N/A	UNCHANGED	N/A
DKR06:2025	Resource Protection	NOT_ASSESSED	N/A	N/A	N/A	N/A	UNCHANGED	N/A

Detailed Remediation Guidance

LOW Severity

DKR02:2025 — Patch Management Strategy

File: .devcontainer/devcontainer.json#L3

Offending Code:

"image": "${localEnv:HVE_DEVCONTAINER_IMAGE:mcr.microsoft.com/devcontainers/base:2-jammy}",

Example Fix:

  - package-ecosystem: "devcontainers"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    labels:
      - "dependencies"
      - "devcontainer"
    commit-message:
      prefix: "chore"
      include: "scope"

Steps:

Open .github/dependabot.yml and add a devcontainers ecosystem entry targeting the root directory, as shown in the example fix above.
Optionally, pin the default image value in .devcontainer/devcontainer.json to a specific digest (e.g., mcr.microsoft.com/devcontainers/base@sha256:<digest>).
Update the enterprise override documentation at docs/customization/enterprise-artifact-hub.md to show a digest-pinned example alongside the existing floating-tag example.
Merge the first automated Dependabot PR to confirm the ecosystem entry works.

Verification verdict: CONFIRMED — Floating tag at .devcontainer/devcontainer.json#L3 confirmed with no Dependabot docker ecosystem entry. Severity remains LOW because this is a development container only.

DKR04:2025 — Secure Defaults and Hardening

File: .devcontainer/devcontainer.json#L1-L42

Offending Code:

{
  "name": "HVE Core - Markdown Editing",
  "image": "${localEnv:HVE_DEVCONTAINER_IMAGE:mcr.microsoft.com/devcontainers/base:2-jammy}",
  "features": {
    "ghcr.io/devcontainers/features/node:1": { "version": "20" },
    "ghcr.io/devcontainers/features/python:1": { "version": "3.11" },
    ...
  },
  "remoteUser": "vscode"
}

Example Fix:

{
  "name": "HVE Core - Markdown Editing",
  "image": "${localEnv:HVE_DEVCONTAINER_IMAGE:mcr.microsoft.com/devcontainers/base:2-jammy}",
  "runArgs": [
    "--security-opt=no-new-privileges"
  ],
  "features": {

Steps:

Open .devcontainer/devcontainer.json and add a "runArgs" key with ["--security-opt=no-new-privileges"] before the "features" key.
Rebuild the devcontainer locally and verify that all on-create.sh tool installations still complete successfully.
Avoid --cap-drop=ALL — development tooling requires several default capabilities.

Verification verdict: DOWNGRADED — Missing runArgs hardening confirmed. Non-root user, development-only context, and SHA256-verified tool installs reduce exploitability. DKR04 reference primarily targets production containers.

Disproved Findings

None.

Remediation Checklist

ID	Control	Status	Evidence
DKR02:2025	Patch Management Strategy	NOT_STARTED
DKR04:2025	Secure Defaults and Hardening	NOT_STARTED

Appendix: Skills Used

Skill	Framework	Version	Reference
owasp-docker	OWASP Docker Top 6	2025	`.github/skills/security/owasp-docker/SKILL.md`

…on.md`

WilliamBerryiii

Nice addition — the vulnerability content is well-structured, technically accurate, and follows the established 7-section format from the other OWASP skills. All agent files, collections, prompts, and docs are updated consistently.

Two items need attention before merge:

Merge conflicts — the PR currently has merge conflicts (mergeable_state: dirty). Please rebase or merge from main to resolve.
Cross-reference alignment — DKR06 maps to upstream D07 (Resource Protection), not D06 (Protect Secrets). The SKILL.md claims numbering is "aligned with OWASP Docker Security numbering" but it isn't. See inline comment for options.

The formatting inconsistency (hyphen vs em dash) and Docker signal suggestions are covered in inline comments.

Reference documents were using the identifier `DKR0x:2025`. However, the source material uses `D0x`. The `2025` postfix also doesn't exist in the source material. The documents were created before 2025 and there's no reference to 2025, unlike other OWASP publications. I also updated `06-resource-protection.md` and mapped it from `DKR06` to `D07` to match the source material.

katriendg · 2026-04-10T06:13:27Z

@JasonTheDeveloper with the merge of the other owasp skill PR there were bound to be some conflicts. Could you merge in the latest and probably after fixing the conflicts regenerate the plugins? Also if you could please resolve all conversations you feel area addressed, then we will do a final review. Thanks!

JasonTheDeveloper · 2026-04-10T06:32:29Z

@JasonTheDeveloper with the merge of the other owasp skill PR there were bound to be some conflicts. Could you merge in the latest and probably after fixing the conflicts regenerate the plugins? Also if you could please resolve all conversations you feel area addressed, then we will do a final review. Thanks!

@katriendg All done, ready to do!

katriendg

Looks good, left two minor comments which I leave to you to edit or simply close at your best judgement. Thanks!

## Pre-Release 3.3.101 ### ✨ Features - add removed maturity tier and retire owasp-docker (#1444) - add evaluation dataset creator (#1279) - align RAI planner with guide, remove scoring, improve UX (#1287) - add PSGallery staleness check and BOM cleanup (#1379) - ISA-95 network planner agent (#1177) - auto-generate collection.md with maturity filtering (#1316) - add folder-consistency check and standardize WARN outp… (#1350) - add synth-data-generate prompt to data-science collection (#1419) - add canonical deck workflow and customer-card rendering for design thinking (#1413) - add Figma MCP integration for DT artifact export (#1222) - introduce `owasp-docker` (#1245) - replace hve-core-specific references with portable discovery-based language (#1335) - introduce `owasp-cicd` (#1246) - add secure-by-design knowledge skill (#1223) - introduce `owasp-infrastructure` (#1244) - introduce `owasp-mcp` (#1207) - add OutputPath parameter to Invoke-LinkLanguageCheck.ps1 (#1229) - add -OutputPath parameter to Validate-SkillStructure.ps1 (#1225) - add maintainer-only skip-review label guard (#1293) - add extension collections overview and integrate into getting started flow (#950) - add agentic workflows for automated issue triage, implementation, PR review, dependency review, and doc-staleness detection (#1219) - consolidate package-lock.json version sync into Update-VersionFiles.ps1 (#1240) - add standards code review agent and full review orchestrator (#1174) - standardize pytest-mock as Python mocking framework (#1170) - add Jira backlog workflows and Jira/GitLab skills (#978) - add centralized version bump script and supply-chain attestation (#1183) ### 🐛 Bug Fixes - pin PowerShell-Yaml to 0.4.7 across all install sites (#1378) - close fork-PR/workflow-file-PR secret-strip gap and normalize upload-artifact version (#1421) - replace stream-based lookahead with array indexing in list-changed-files.sh (#1376) - centralize ISO 8601 timestamp regex in CIHelpers (#1343) - update stale documentation date in release-process.md (#1363) - pin basic-ftp to 5.3.0 to resolve GHSA-rp42-5vxx-qpwr (#1374) - add bot filter to dependency PR review workflow (#1362) - resolve pip-audit findings in powerpoint, gitlab, and jira skill lock files (#1360) - standardize Timestamp JSON key casing across all lint result files (#1314) - add synchronize trigger to PR Review workflow (#1323) - standardize timestamp in Validate-SkillStructure.ps1 to use Get-StandardTimestamp (#1280) - add parallel subagent dispatch and structured JSON contracts to code-review-full (#1304) - standardize timestamp in SecurityHelpers.psm1 to use Get-StandardTimestamp (#1284) - standardize timestamps in Test-DependencyPinning.ps1 and SecurityClasses.psm1 (#1282) - derive collection artifact counts from YAML at build time (#1275) - standardize timestamp in FrontmatterValidation.psm1 to use Get-StandardTimestamp (#1285) - standardize timestamp in Markdown-Link-Check.ps1 to use Get-StandardTimestamp (#1283) - escape hyphens in Mermaid diagram on Collections page (#1262) - add summary timestamp to PSScriptAnalyzer output (#1211) - fix plugin compatibility and robustness for coding-standards code review agents (#1289) - standardize timestamp in Test-CopyrightHeaders.ps1 to use Get-StandardTimestamp (#1278) - standardize timestamp in Invoke-YamlLint.ps1 to use Get-StandardTimestamp (#1270) - standardize timestamp in Invoke-LinkLanguageCheck.ps1 to use Get-StandardTimestamp (#1264) - fix dependency-review path filters and sparse-checkout cone mode (#1259) - replace invalid bare tool names with official tool identifiers (#1198) - fix broken links and remove orphaned reference in code review docs (#1257) - exclude Python env dirs from skill validation warnings (#1255) - pin happy-dom and serialize-javascript to resolve Dependabot vulnerabilities (#1253) - remove Mermaid diagram and add missing collection cards (#1247) - disable MCP servers by default to prevent token limit errors (#1144) - sync package-lock.json after pre-release version bump (#1236) - separate mermaid node declarations and add dynamic diagram generation with tests (#1215) - replace anchor links in meeting-analyst with bold text references (#1201) - remove recursive symlinks in jira and gitlab skill directories (#1233) - validate-installation scripts now check .github/skills directory (#1010) (#1206) - resolve npm audit vulnerabilities via dependency overrides (#1200) - add post-release triggers to scorecard workflow (#1186) - add missing .md extensions to relative links in agent documentation (#1180) ### 📚 Documentation - broaden Security Review description beyond OWASP (#1385) - document maintainer advisory mode and skip-review label guard (#1386) - document ExcludePaths/OutputPath for Invoke-LinkLanguageCheck (#1383) - CLI getting-started: clarify plugin install commands as alternatives (-all vs base) (#1251) ### ♻️ Refactoring - align agent and prompt folder names to collection identifier (#1210) ### 🔧 Maintenance - pin PSScriptAnalyzer to 1.25.0 and sync stale workflow version comments (#1389) - bump lxml from 6.0.2 to 6.1.0 in /.github/skills/experimental/powerpoint (#1424) - bump @vscode/vsce from 3.7.1 to 3.9.1 in the npm-dependencies group (#1390) - bump the github-actions group across 1 directory with 7 updates (#1391) - bump follow-redirects from 1.15.11 to 1.16.0 in /docs/docusaurus (#1356) - upgrade Node.js from 20 to 24 and bump cspell to v10 (#1353) - bump basic-ftp from 5.2.0 to 5.2.1 (#1324) - update github/gh-aw-actions requirement to 536ea1bad8c6715d098a9dc1afea8d403733acfe in the github-actions group across 1 directory (#1298) - update security instruction attributions and compliance (#1294) - bump the npm-dependencies group with 2 updates (#1297) - pre-release 3.3.41 (#1252) - streamline RAI Planner phase structure and documentation (#1273) - bump happy-dom from 20.8.8 to 20.8.9 in /docs/docusaurus (#1237) - pre-release 3.3.27 (#1191) - bump pygments from 2.19.2 to 2.20.0 in /.github/skills/gitlab/gitlab (#1234) - bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/docusaurus (#1226) - bump the github-actions group with 4 updates (#1231) - add missing folders and alphabetize location lists (#1193) - bump brace-expansion (#1224) - bump handlebars from 4.7.8 to 4.7.9 in /docs/docusaurus (#1217) - bump brace-expansion from 5.0.3 to 5.0.5 in /docs/docusaurus (#1213) - pre-release 3.3.10 (#1187) - bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group (#1175) - bump the github-actions group with 3 updates (#1176) - pre-release 3.3.1 (#1165) --- *Managed automatically by pre-release workflow.* Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

JasonTheDeveloper added 6 commits March 31, 2026 14:57

feat(skill): introduce owasp-docker

b65924a

feat(agents): add reference to owasp-docker skill

4eaa4cb

feat(agent): update CUSTOM-AGENTS.md to add reference to `owasp-doc…

3f91f4e

…ker`

feat(prompt): update targetSkill to allow owasp-docker option

de096a9

feat(collections): add owasp-docker

27f09fd

feat(plugins): add owasp-docker

944d996

JasonTheDeveloper requested a review from a team as a code owner March 31, 2026 04:21

JasonTheDeveloper added 3 commits April 1, 2026 10:56

Merge branch 'main' into feat/1242

ea651c2

feat(skills): set user-invocable: false

707eedd

feat(skills): append description with `Brought to you by microsoft/hv…

76fb718

…e-core`

JasonTheDeveloper added 7 commits April 2, 2026 12:07

Merge branch 'main' into feat/1242

739a714

fix(docs): update collectionCards.ts with updated artifact count

72c8613

Merge branch 'main' into feat/1242

19eb8ec

docs(collections): include owasp-docker skill in `security.collecti…

27e3737

…on.md`

docs(plugin): update readme

cb965a1

Merge branch 'main' into feat/1242

1e2ba00

fix(skill): update license to reflect source material license

d2e828a

JasonTheDeveloper force-pushed the feat/1242 branch from 45e9628 to d2e828a Compare April 3, 2026 08:44

Merge branch 'main' into feat/1242

9ff20a2

WilliamBerryiii requested changes Apr 8, 2026

View reviewed changes

Comment thread .github/skills/security/owasp-docker/SKILL.md

Comment thread .github/prompts/security/security-review.prompt.md

Comment thread .github/agents/security/subagents/codebase-profiler.agent.md

Comment thread collections/security.collection.md

JasonTheDeveloper added 2 commits April 9, 2026 15:09

feat(agent): expand docker related signals

1868294

JasonTheDeveloper force-pushed the feat/1242 branch from 4daf3cb to 1868294 Compare April 9, 2026 05:21

docs(skill): add third-party attribution to SKILL.md

001ed2f

JasonTheDeveloper added 2 commits April 10, 2026 16:27

Merge branch 'main' into feat/1242

1d370e2

chore(plugin): refresh

15bc18e

JasonTheDeveloper force-pushed the feat/1242 branch from 0b020c3 to 15bc18e Compare April 10, 2026 06:30

JasonTheDeveloper requested a review from WilliamBerryiii April 10, 2026 06:31

katriendg approved these changes Apr 10, 2026

View reviewed changes

Comment thread .github/skills/security/owasp-docker/references/00-vulnerability-index.md Outdated

Comment thread .github/skills/security/owasp-docker/SKILL.md

JasonTheDeveloper and others added 4 commits April 10, 2026 19:45

docs(skill): remove year from 00-vulnerability-index.md

fdf6ff0

Merge branch 'main' into feat/1242

8eb1d32

Merge branch 'main' into feat/1242

da096d5

Merge branch 'main' into feat/1242

7153707

WilliamBerryiii approved these changes Apr 20, 2026

View reviewed changes

WilliamBerryiii merged commit f83192e into microsoft:main Apr 20, 2026
45 of 46 checks passed

This was referenced Apr 20, 2026

chore(main): pre-release 3.3.101 #1274

Merged

chore(main): release hve-core 3.4.0 #1184

Open

github-actions Bot mentioned this pull request Apr 20, 2026

docs: update collections overview table with current artifact counts #1414

Open

hve-core-release-please Bot mentioned this pull request Apr 27, 2026

chore(main): pre-release 3.3.111 #1476

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(skill): introduce `owasp-docker`#1245

feat(skill): introduce `owasp-docker`#1245
WilliamBerryiii merged 26 commits intomicrosoft:mainfrom
JasonTheDeveloper:feat/1242

JasonTheDeveloper commented Mar 31, 2026

Uh oh!

codecov-commenter commented Mar 31, 2026 •

edited

Loading

Uh oh!

JasonTheDeveloper commented Apr 1, 2026

Uh oh!

WilliamBerryiii left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

katriendg commented Apr 10, 2026

Uh oh!

JasonTheDeveloper commented Apr 10, 2026 •

edited

Loading

Uh oh!

katriendg left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

JasonTheDeveloper commented Mar 31, 2026

Pull Request

Description

Related Issue(s)

Type of Change

Testing

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Uh oh!

codecov-commenter commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

JasonTheDeveloper commented Apr 1, 2026

OWASP Security Assessment Report

Executive Summary

Summary Counts

Severity Breakdown (FAIL + PARTIAL only)

Verification Summary

Findings by Framework

owasp-docker

Detailed Remediation Guidance

LOW Severity

DKR02:2025 — Patch Management Strategy

DKR04:2025 — Secure Defaults and Hardening

Disproved Findings

Remediation Checklist

Appendix: Skills Used

Uh oh!

WilliamBerryiii left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

katriendg commented Apr 10, 2026

Uh oh!

JasonTheDeveloper commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

katriendg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov-commenter commented Mar 31, 2026 •

edited

Loading

JasonTheDeveloper commented Apr 10, 2026 •

edited

Loading