owasp-serverless-top-10
OWASP Serverless Top 10
This skill encodes the OWASP Top 10 Serverless Interpretation for secure serverless design and review. References are loaded per risk. Based on OWASP Top 10 Serverless Interpretation 2018. See the official PDF for the exact 10 categories.
When to Read Which Reference
| Risk | Read |
|---|---|
| SL1 Injection (Serverless) | references/sl01-injection.md |
| SL2 Broken Authentication (Serverless) | references/sl02-broken-auth.md |
| SL3 Sensitive Data Exposure (Serverless) | references/sl03-sensitive-data-exposure.md |
| SL4 XML External Entities (Serverless) | references/sl04-xxe.md |
| SL5 Broken Access Control (Serverless) | references/sl05-broken-access-control.md |
| SL6 Security Misconfiguration (Serverless) | references/sl06-misconfiguration.md |
| SL7 XSS (Serverless) | references/sl07-xss.md |
| SL8 Insecure Deserialization (Serverless) | references/sl08-insecure-deserialization.md |
| SL9 Using Components with Known Vulnerabilities (Serverless) | references/sl09-vulnerable-components.md |
| SL10 Insufficient Logging and Monitoring (Serverless) | references/sl10-logging-monitoring.md |
More from yariv1025/skills
owasp-mobile-top-10
OWASP Mobile Top 10 - prevention, detection, and remediation for iOS/Android app security. Use when building or reviewing mobile apps - credentials, supply chain, auth, input/output validation, communication, privacy, binary protection, config, data storage, cryptography.
16owasp-api-security-top-10
OWASP API Security Top 10 - prevention, detection, and remediation for REST/GraphQL/API security. Use when designing or reviewing APIs - object- and function-level authorization, authentication, rate limiting and resource consumption, sensitive business flows, SSRF, API inventory and versioning, or consumption of third-party APIs.
14agent-dev-guardrails
Enforce disciplined agent development workflows with plan-first development, small-slice execution, specialized self-review roles, quality gates, and project setup. Use when starting a new project, setting up development conventions, wanting structured planning, or needing the agent to follow best practices for code quality, review, and validation.
8owasp-iot-top-10
OWASP IoT Top 10 - prevention, detection, and remediation for IoT device and ecosystem security. Use when designing or reviewing IoT devices - passwords, network services, ecosystem interfaces, secure updates, components, data transfer/storage, device management, default settings, physical hardening, privacy.
7owasp-privacy-top-10
OWASP Top 10 Privacy Risks - prevention, detection, and remediation for privacy in web applications. Use when addressing app vulnerabilities, data leakage, breach response, consent, transparency, data deletion, data quality, session expiration, user access rights, excessive data collection.
6owasp-cicd-top-10
OWASP Top 10 CI/CD Security Risks - prevention, detection, and remediation for pipeline security. Use when securing or reviewing CI/CD - flow control, IAM, dependency chain, poisoned pipeline execution, PBAC, credential hygiene, system config, third-party services, artifact integrity, logging and visibility.
6