Security Reviewer Formats

microsoft/security-reviewer-formats

Format specifications and data contracts for the security reviewer orchestrator and its subagents.

4k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

1313

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/microsoft/hve-core --skill security-reviewer-formats

14 895 bytes besides the instruction

references/completion-formats.md

references/finding-formats.md

references/report-formats.md

references/severity-definitions.md

found in the instruction text

Task spawns other agents

3 sections, as written by the author

This SKILL.md is the entrypoint for the security reviewer format specifications skill.

The skill provides shared format templates and data contracts used by the security reviewer

orchestrator and its subagents during vulnerability assessments. Each reference file covers

a focused area of the reporting pipeline.

Report Formats — VULN_REPORT_V1 template, diff mode qualifiers, and PLAN_REPORT_V1 template.
Finding Formats — Finding Serialization Format and Verified Findings Collection Format.
Completion Formats — Scan Status Format, Scan Completion Format, and Minimal Profile Stub Format.
Severity Definitions — Standard severity level definitions for all OWASP skill assessments.

SKILL.md — this file (skill entrypoint).
references/ — format specification documents.
report-formats.md — full report templates for audit, diff, and plan modes.
finding-formats.md — serialization and collection formats for findings exchange between subagents.
completion-formats.md — status updates, completion summaries, and the minimal profile stub.
severity-definitions.md — severity level table shared across all assessments.

Copy the folder

Take microsoft/security-reviewer-formats from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.