Security Skills for AI Coding Agents v1.0

25 structured security skills across 10 domains + 5 role bundles.
Grounded in OWASP, NIST, MITRE ATT&CK, CIS Controls.

Skills: appsec (5), ai-security (6), identity (5), cloud (5),
vuln-management (4), compliance (5), incident-response (4),
secops (4), network (3), devsecops (4)

Roles: vCISO, SOC Analyst, Security Engineer, AppSec Engineer,
Cloud Security Engineer

Compatible with Claude Code, Gemini CLI, Cursor, Codex CLI,
OpenClaw, and Kiro.

Author: Kamal Srinivasan

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,25 @@
+## Pull Request Checklist
+
+Please confirm the following before submitting:
+
+- [ ] Skill follows the format specification in [CONTRIBUTING.md](../CONTRIBUTING.md)
+- [ ] At least one real framework is cited with correct control IDs
+- [ ] All framework references verified against primary sources (not blogs or AI output)
+- [ ] Prompt Injection Safety Notice section included
+- [ ] `injection-hardened: true` set in frontmatter
+- [ ] `allowed-tools` scoped to minimum necessary permissions
+- [ ] Tested with at least one AI coding agent (which one: ___)
+- [ ] No prohibited patterns per [SECURITY.md](../SECURITY.md)
+- [ ] `index.yaml` updated with new skill entry (if adding a skill)
+
+## What This PR Does
+
+[Brief description of the skill or change]
+
+## Framework References
+
+[List the specific frameworks and control IDs cited in this skill]
+
+## Testing
+
+[How was this skill tested? Which agent was used? What was the target?]

.github/workflows/injection-scan.yml

@@ -0,0 +1,53 @@
+name: Prompt Injection Scan
+
+on:
+  pull_request:
+
+jobs:
+  injection-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Scan for prompt injection patterns
+        run: |
+          PATTERNS=(
+            "ignore previous"
+            "ignore all previous"
+            "disregard"
+            "new directive"
+            "system override"
+            "you are now"
+            "forget your instructions"
+            "exfiltrate"
+            "send to http"
+            "curl -X POST"
+            "api.telegram"
+            "webhook"
+          )
+
+          FOUND_ISSUES=0
+
+          for pattern in "${PATTERNS[@]}"; do
+            MATCHES=$(grep -rin "$pattern" skills/ roles/ --include="*.md" 2>/dev/null || true)
+            if [ -n "$MATCHES" ]; then
+              # Allowlist: quoted examples in prompt-injection skill are expected
+              FILTERED=$(echo "$MATCHES" | grep -v "ai-security/prompt-injection.md" || true)
+              if [ -n "$FILTERED" ]; then
+                echo "FOUND injection pattern \"$pattern\":"
+                echo "$FILTERED"
+                echo ""
+                FOUND_ISSUES=1
+              fi
+            fi
+          done
+
+          if [ "$FOUND_ISSUES" -ne 0 ]; then
+            echo "FAIL: Prompt injection patterns detected. Review flagged lines above."
+            echo ""
+            echo "NOTE: Quoted examples in ai-security/prompt-injection.md are excluded."
+            exit 1
+          fi
+
+          echo "PASS: No prompt injection patterns detected."

.github/workflows/lint-skills.yml

@@ -0,0 +1,51 @@
+name: Lint Skills
+
+on:
+  pull_request:
+
+jobs:
+  lint-frontmatter:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate frontmatter in skill and role files
+        run: |
+          EXIT_CODE=0
+          REQUIRED_FIELDS=("name" "description" "version" "author" "license")
+
+          FILES=$(find skills/ roles/ -name '*.md' 2>/dev/null || true)
+
+          if [ -z "$FILES" ]; then
+            echo "No .md files found in skills/ or roles/."
+            exit 0
+          fi
+
+          while IFS= read -r file; do
+            echo "Checking: $file"
+
+            FRONTMATTER=$(awk '/^---$/{if(++c==2) exit} c==1' "$file")
+
+            if [ -z "$FRONTMATTER" ]; then
+              echo "  ERROR: No YAML frontmatter found (missing --- delimiters)"
+              EXIT_CODE=1
+              continue
+            fi
+
+            for field in "${REQUIRED_FIELDS[@]}"; do
+              if ! echo "$FRONTMATTER" | grep -qE "^${field}:"; then
+                echo "  ERROR: Missing required field: $field"
+                EXIT_CODE=1
+              fi
+            done
+          done <<< "$FILES"
+
+          if [ "$EXIT_CODE" -ne 0 ]; then
+            echo ""
+            echo "FAIL: One or more files have missing required frontmatter fields."
+            exit 1
+          fi
+
+          echo ""
+          echo "All frontmatter checks passed."

.github/workflows/validate-index.yml

@@ -0,0 +1,63 @@
+name: Validate Index
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  validate-index:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install yq
+        run: |
+          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+
+      - name: Validate all indexed files exist
+        run: |
+          EXIT_CODE=0
+
+          # Check skill files
+          SKILL_FILES=$(yq eval '.skills[].file' index.yaml)
+          echo "Checking skill files listed in index.yaml..."
+          while IFS= read -r filepath; do
+            if [ -z "$filepath" ] || [ "$filepath" = "null" ]; then
+              continue
+            fi
+            if [ ! -f "$filepath" ]; then
+              echo "MISSING: $filepath"
+              EXIT_CODE=1
+            else
+              echo "OK: $filepath"
+            fi
+          done <<< "$SKILL_FILES"
+
+          # Check role files
+          ROLE_FILES=$(yq eval '.roles[].file' index.yaml)
+          echo ""
+          echo "Checking role files listed in index.yaml..."
+          while IFS= read -r filepath; do
+            if [ -z "$filepath" ] || [ "$filepath" = "null" ]; then
+              continue
+            fi
+            if [ ! -f "$filepath" ]; then
+              echo "MISSING: $filepath"
+              EXIT_CODE=1
+            else
+              echo "OK: $filepath"
+            fi
+          done <<< "$ROLE_FILES"
+
+          if [ "$EXIT_CODE" -ne 0 ]; then
+            echo ""
+            echo "FAIL: One or more files listed in index.yaml do not exist."
+            exit 1
+          fi
+
+          echo ""
+          echo "All indexed files are present."

.gitignore

@@ -0,0 +1,12 @@
+# OS files
+.DS_Store
+Thumbs.db
+
+# Editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# Plan file (internal reference, not published)
+skillsrepo.md