Security Planning Agent Skill
Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding.
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/microsoft/hve-core --skill security-planningWhat comes with it
11 540 bytes besides the instructionThe instruction itself
4 sections, as written by the authorSecurity Planning
This skill packages the durable security-planning reference material used by the Security Planner: operational bucket guidance, STRIDE analysis patterns, standards cross-references, NIST control-family references, and security-specific backlog formats.
When to use
Use this skill when you need to:
- Classify application components into the operational security buckets used during planning.
- Evaluate threats with STRIDE-based analysis, including AI-specific extensions when
raiEnabledis true. - Map bucket findings to standards references and control families without re-embedding long standard tables.
- Derive security-specific backlog priorities and RAI work item categories for Phase 5 handoff.
Skill layout
Load the reference file that matches the phase or topic you need.
| Reference | Topic |
|------------------------------------------------------------------------------------|-------------------------------------------------------------------------|
| references/00-index.md | Navigation catalog and consolidated attribution |
| references/operational-buckets.md | Operational bucket definitions, GS overlay, and classification guidance |
| references/stride-model.md | STRIDE methodology, AI extensions, risk matrix, and data-flow analysis |
| references/standards-cross-reference.md | Bucket-to-standards mapping table and component mapping output format |
| references/nist-control-families.md | NIST 800-53 priority tiers and NIST AI RMF subcategory mappings |
| references/backlog-formats.md | Security-specific prioritization and RAI work item categories |
Attribution
The durable reference content in this skill is organized by reference file and summarized in references/00-index.md. See that index for the consolidated attribution and delegation notes.
Other skills for the same job
different authors, same section of the catalogue
This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.
Use when the user supplies or imports existing security findings, vulnerability reports, or security/vulnerability Jira/Linear tickets from scanners, advisories, GitHub, Atlassian Rovo, Linear, or similar backlog sources and wants static repo-impact triage. Do not use for discovery, duplicate-bug triage, validation, or fixes.
SWOT strategic analysis examining Strengths, Weaknesses, Opportunities, and Threats. Use for strategic planning, competitive analysis, career decisions, or evaluating opportunities.
Orchestrate multiple Antigravity skills through guided workflows for SaaS MVP delivery, security audits, AI agent builds, and browser QA.
Integrates with Atlassian products to manage project tracking and documentation via MCP protocol. Use when querying Jira issues with JQL filters, creating and updating tickets with custom fields, searching or editing Confluence pages with CQL, managing sprints and backlogs, setting up MCP server authentication, syncing documentation, or debugging Atlassian API integrations.
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques. Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation.
Use when an agent folder must pass the Agentlas Cloud 2-stage security scan (static rules + BYOK LLM judgment) before private sync or public publish, or when asked to run/interpret `hephaestus security scan`.
> Cross-functional what-if modeling for compound adversity -- shows how one problem cascades into the next. Use when facing complex risk scenarios, strategic decisions with major downside, or multi-variable threats.
How to use it
Take microsoft/security-planning from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.