id: security
name: Security
description: Security review, planning, incident response, risk assessment, and vulnerability analysis
notice: |
  > [!CAUTION]
  > The security agents and prompts in this collection are **assistive tools only**. They do not replace professional security tooling (SAST, DAST, SCA, penetration testing, compliance scanners) or qualified human review. All AI-generated security artifacts **must** be reviewed and validated by qualified security professionals before use. AI outputs may contain inaccuracies, miss critical threats, or produce recommendations that are incomplete or inappropriate for your environment.
tags:
  - security
  - incident-response
  - risk
  - planning
  - review
  - vulnerability
  - threat-modeling
  - supply-chain
  - rai
  - responsible-ai
items:
  # Agents
  - path: .github/agents/security/security-planner.agent.md
    kind: agent
    maturity: experimental
  - path: .github/agents/security/sssc-planner.agent.md
    kind: agent
    maturity: experimental
  - path: .github/agents/rai-planning/rai-planner.agent.md
    kind: agent
    maturity: experimental
  - path: .github/agents/hve-core/subagents/researcher-subagent.agent.md
    kind: agent
  - path: .github/agents/security/security-reviewer.agent.md
    kind: agent
    maturity: experimental
  - path: .github/agents/security/subagents/codebase-profiler.agent.md
    kind: agent
    maturity: experimental
  - path: .github/agents/security/subagents/finding-deep-verifier.agent.md
    kind: agent
    maturity: experimental
  - path: .github/agents/security/subagents/report-generator.agent.md
    kind: agent
    maturity: experimental
  - path: .github/agents/security/subagents/skill-assessor.agent.md
    kind: agent
    maturity: experimental
  # Skills
  - path: .github/skills/security/owasp-top-10
    kind: skill
    maturity: experimental
  - path: .github/skills/security/owasp-llm
    kind: skill
    maturity: experimental
  - path: .github/skills/security/owasp-agentic
    kind: skill
    maturity: experimental
  - path: .github/skills/security/owasp-mcp
    kind: skill
    maturity: experimental
  - path: .github/skills/security/owasp-infrastructure
    kind: skill
    maturity: experimental
  - path: .github/skills/security/owasp-cicd
    kind: skill
    maturity: experimental
  - path: .github/skills/security/owasp-docker
    kind: skill
    maturity: removed
  - path: .github/skills/security/secure-by-design
    kind: skill
    maturity: experimental
  - path: .github/skills/security/security-reviewer-formats
    kind: skill
    maturity: experimental
  - path: .github/skills/shared/pr-reference
    kind: skill
  # Security Planner Prompts
  - path: .github/prompts/security/security-capture.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/security-plan-from-prd.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/incident-response.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/risk-register.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/security-review.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/security-review-llm.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/security-review-web.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/security-review-sbd.prompt.md
    kind: prompt
    maturity: experimental
  # SSSC Planner Prompts
  - path: .github/prompts/security/sssc-capture.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/sssc-from-prd.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/sssc-from-brd.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/security/sssc-from-security-plan.prompt.md
    kind: prompt
    maturity: experimental
  # RAI Planner Prompts
  - path: .github/prompts/rai-planning/rai-capture.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/rai-planning/rai-plan-from-prd.prompt.md
    kind: prompt
    maturity: experimental
  - path: .github/prompts/rai-planning/rai-plan-from-security-plan.prompt.md
    kind: prompt
    maturity: experimental
  # Security Planner Instructions
  - path: .github/instructions/security/identity.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/security/operational-buckets.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/security/standards-mapping.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/security/security-model.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/security/backlog-handoff.instructions.md
    kind: instruction
    maturity: experimental
  # SSSC Planner Instructions
  - path: .github/instructions/security/sssc-identity.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/security/sssc-assessment.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/security/sssc-standards.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/security/sssc-gap-analysis.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/security/sssc-backlog.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/security/sssc-handoff.instructions.md
    kind: instruction
    maturity: experimental
  # RAI Planner Instructions
  - path: .github/instructions/rai-planning/rai-identity.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/rai-planning/rai-standards.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/rai-planning/rai-risk-classification.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/rai-planning/rai-security-model.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/rai-planning/rai-impact-assessment.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/rai-planning/rai-backlog-handoff.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/rai-planning/rai-capture-coaching.instructions.md
    kind: instruction
    maturity: experimental
  # Shared Instructions
  - path: .github/instructions/shared/planner-identity-base.instructions.md
    kind: instruction
    maturity: experimental
  - path: .github/instructions/shared/coaching-patterns.instructions.md
    kind: instruction
  - path: .github/instructions/shared/disclaimer-language.instructions.md
    kind: instruction
  - path: .github/instructions/shared/hve-core-location.instructions.md
    kind: instruction
  # Telemetry
  - path: .github/skills/shared/telemetry-foundations
    kind: skill
  - path: .github/skills/shared/backlog-templates
    kind: skill
    maturity: experimental
  - path: .github/instructions/security/security-planner-telemetry.instructions.md
    kind: instruction
  - path: .github/instructions/security/sssc-planner-telemetry.instructions.md
    kind: instruction
  - path: .github/instructions/rai-planning/rai-planner-telemetry.instructions.md
    kind: instruction
display:
  ordering: manual
