Secure By Design Agent Skill

Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle.

13k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

1313

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/microsoft/hve-core --skill secure-by-design

What comes with it

48 244 bytes besides the instruction

references/00-principle-index.md

references/01-security-governance.md

references/02-risk-driven-approach.md

references/03-secure-product-development.md

references/04-supply-chain-security.md

references/05-usable-security-controls.md

references/06-detect-and-respond.md

references/07-flexible-architecture.md

references/08-minimize-attack-surface.md

references/09-defense-in-depth.md

references/10-continuous-assurance.md

references/11-secure-deprecation.md

The instruction itself

6 sections, as written by the author

Secure by Design — Skill Entry

This SKILL.md is the entrypoint for the Secure by Design skill.

The skill synthesizes the UK Government Secure by Design Principles (10 principles) and the

Australian ASD/ACSC Secure by Design Foundations (6 foundations) into structured,

machine-readable references that an agent can query to identify, assess, and improve adherence to

secure-by-design practices across the software lifecycle.

Normative references (Secure by Design)

00 Principle Index
01 Security Governance
02 Risk-Driven Approach
03 Secure Product Development
04 Supply Chain Security
05 Usable Security Controls
06 Detect and Respond
07 Flexible Architecture
08 Minimize Attack Surface

10. 09 Defense in Depth

11. 10 Continuous Assurance

12. 11 Secure Deprecation

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — the Secure by Design normative documents.
00-principle-index.md — index of all principle identifiers, categories, source mappings, and cross-references.
01 through 11 — one document per synthesized principle area merging UK and AU guidance.

Third-Party Attribution

UK Government Secure by Design Principles

Copyright: Crown Copyright, UK Government Security Group
License: Open Government Licence v3.0 (OGL-UK-3.0)
Source: <https://www.security.gov.uk/policy-and-guidance/secure-by-design/principles/>
Modifications: Synthesized into structured principle-checklist format with cross-references; merged with Australian guidance into unified principle areas
Trademark: Use of UK Government content does not imply endorsement

Australian ASD/ACSC Secure by Design Foundations

Copyright: © Commonwealth of Australia, Australian Signals Directorate
License: Creative Commons Attribution 4.0 (CC-BY-4.0)
Source: <https://www.cyber.gov.au/business-government/secure-design/secure-by-design/secure-by-design-foundations>
Modifications: Synthesized into structured principle-checklist format with cross-references; merged with UK guidance into unified principle areas
Trademark: Use of ASD/ACSC content does not imply endorsement

Other skills for the same job

different authors, same section of the catalogue

C4 Architecture

by softaworks

×2

Generate architecture documentation using C4 model Mermaid diagrams. Use when asked to create architecture diagrams, document system architecture, visualize software structure, create C4 diagrams, or generate context/container/component/deployment diagrams. Triggers include "architecture diagram", "C4 diagram", "system context", "container diagram", "component diagram", "deployment diagram", "document architecture", "visualize architecture".

Expert C4 Container-level documentation specialist. Synthesizes Component-level documentation into Container-level architecture, mapping components to deployment units, documenting container interfaces as APIs, and creating container diagrams. Use when synthesizing components into deployment containers and documenting system deployment architecture.

When the user wants to create or update a README.md file for a project. Also use when the user says 'write readme,' 'create readme,' 'document this project,' 'project documentation,' or asks for help with README.md. This skill creates absurdly thorough documentation covering local setup, architecture, and deployment.

8k tokens

Convex Migration Helper

by get-convex

×1

Plans and executes safe Convex schema and data migrations using the widen-migrate-narrow workflow and the @convex-dev/migrations component. Use this skill when a deployment fails schema validation, existing documents need backfilling, fields need adding or removing or changing type, tables need splitting or merging, or a zero-downtime migration strategy is needed. Also use when the user mentions breaking schema changes, multi-deploy rollouts, or data transformations on existing Convex tables.

4k tokens

Azure AI Document Intelligence Dotnet

by lingxling

×1

Azure AI Document Intelligence SDK for .NET. Extract text, tables, and structured data from documents using prebuilt and custom models.

3k tokens

Azure AI Vision Imageanalysis Java

by lingxling

×1

Build image analysis applications with Azure AI Vision SDK for Java. Use when implementing image captioning, OCR text extraction, object detection, tagging, or smart cropping.

2k tokens

Azure AI Vision Imageanalysis Py

by lingxling

×1

Azure AI Vision Image Analysis SDK for captions, tags, objects, OCR, people detection, and smart cropping. Use for computer vision and image understanding tasks.

2k tokens

Azure Search Documents Ts

by lingxling

×1

Build search applications with vector, hybrid, and semantic search capabilities.

2k tokens

How to use it

Copy the folder

Take microsoft/secure-by-design from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.