Identifies, assesses, and remediates CI/CD pipeline security risks using the OWASP Top 10.
npx skills add https://github.com/microsoft/hve-core --skill owasp-cicd
Please help me install this Agent Skill. Skill: owasp-cicd Source: https://github.com/microsoft/hve-core/tree/main/.github/skills/security/owasp-cicd Command: npx skills add https://github.com/microsoft/hve-core --skill owasp-cicd
CI/CD pipelines are high-value attack targets, but most teams lack a structured way to identify and fix pipeline security weaknesses. This Skill encodes the OWASP Top 10 CI/CD Security Risks as machine-readable references so an agent can systematically assess and remediate pipeline vulnerabilities.
Assess my CI/CD pipeline configuration against the OWASP CI/CD Top 10 and list any vulnerabilities with remediation steps.
High-intent search queries and answers about installing and using this skill.
Use the OWASP CI/CD Top 10 framework to systematically review your pipeline against ten risk categories, from insufficient flow control to inadequate logging. Each category includes a vulnerability checklist you can map to your SCM, CI, and artifact repository configurations.
Poisoned Pipeline Execution (CICD-SEC-4) occurs when an attacker with source control access injects malicious commands into CI configuration or referenced files. Prevent it by isolating pipelines running unreviewed code, protecting CI configuration files, and scoping pipeline credentials minimally.
The ten risks are: insufficient flow control, inadequate identity and access management, dependency chain abuse, poisoned pipeline execution, insufficient PBAC, insufficient credential hygiene, insecure system configuration, ungoverned third-party usage, improper artifact integrity validation, and insufficient logging and visibility.
Route all package fetches through an internal proxy, register internal package names under your organization's scope, pin dependency versions with lock files, and enable checksum and signature verification. Run pre-install scripts in isolated contexts without access to secrets.
Yes, the reference guidance is platform-agnostic and includes example scenarios for GitHub Actions workflows and Jenkins pipelines. The checklists and controls apply to any SCM, CI server, or artifact repository, whether self-managed or SaaS.
This skill provides reference guidance rather than automated scanning; it does not execute tools or directly inspect your infrastructure. You must apply its checklists and detection guidance manually or pair it with dedicated scanning and monitoring tools.
latestaiagentsIdentify and remediate known vulnerabilities in third-party software dependencies.
chf3198Identify secret leakage patterns and validate exclusion rules across git history and CI pipelines.
eleva-labsPlan security audits with checklists for dependency scanning and secret detection.
snoodleboot-ioScan container images and enforce runtime security and network policies.
