Secure-AI-Toolkit - Security-focused Markdown skills for AI coding ass

项目说明

Secure AI Toolkit

Security skills for AI coding assistants. Plain Markdown, no runtime, no dependencies, no
install step.

An assistant that writes code will make security decisions whether or not you asked it to.
Left alone it produces plausible-looking advice: sanitize your inputs, use HTTPS, don't store
passwords in plaintext. True, generic, and untraceable. Nobody can review it, because there
is nothing to review it against.

This repository is the other approach. Every control here names the OWASP Top 10 category and
AS it serves, plus a CWE where one applies. That makes a finding defensible, a fix
checkable, and a disagreement resolvable by reading the standard rather than by arguing about
instinct.

> Using this with an AI assistant? Point it at
> AI_INSTRUCTIONS.md - that is the machine-facing entry point, with the
> skill registry, routing rules, and output contract. This README is the human introduction.

Why this exists

Three problems, all of them observable in AI-generated code today.

Generic advice does not survi. " user input" tells a de nothing
about whether the fix belongs at the boundary or at the sink, whether an allowlist or a regex
is appropriate, or what the endpoint still leaks afterwards. A control tied to
A05:2025 · ASVS V2 · CWE-89 can be argued about precisely.

Recalled category IDs are wrong more often than they look. The OWASP Top 10 renumbers
between editions. An assistant confidently citing "A03 Injection" is working from the 2021
list; in 2025 A03 is Software Supply Chain Failures and Injection is A05. Every claim
in this repository carries the source URL and the date it was checked, so staleness is
instead of in.

O a security tool is itself a risk. A checklist that returns all green teaches
people to ignore checklists. The skills here state their gaps: the SSRF example says outright
that its own fix remains open to DNS rebinding, and the file upload example names polyglot
files as a limit of magic-number detection. That honesty is the design, not an o.

What is inside

Skills are directories of Markdown. Nothing executes, nothing is fetched at runtime, nothing
needs building. An assistant reads SKILL.md, follows its workflow, and pulls in supporting
files as needed.

Each skill follows the same shape:

The workflow inside SKILL.md is fi - scope, map, apply, , report - and the
step is the one that matters most in practice. It is what turns "here is some code"
into "here is some code, and here is what I checked and what I could not."

Status

All 48 skills are written end to end. Every skill includes its workflow, checklist, real
/fixed code, limitations, and references.

| Area | State |
|---|---|
| core/* (26) | Complete |
| ad/* (6) | Complete |
| enterprise/* (6) | Complete |
| architecture/* (10) | Complete |
| shared/checklists, shared/prompts, shared/references | Ready |
| shared/templates | Skill scaffold, ready to copy |

A directory is not marked complete because SKILL.md exists. It is complete only after its
checklist, examples, references, placeholder scan, frontmatter, and limitations have been
. Half-written security guidance is worse than none: it looks authoritative and covers
less than it appears to.

Quick start

Nothing to build and nothing to install. Clone it and point your assistant at
AI_INSTRUCTIONS.md:

Keep the repository in your project, or beside it, and the assistant reads
skills/core/owasp/SKILL.md in place. That is the whole setup for most tools.

To get /owasp-style in and automatic routing in Claude Code, install the skills
properly - see below.

Installing as Claude Code skills

Claude Code discovers a skill as a directory containing SKILL.md, one le a
skills directory. It does not recurse into category folders, so the four categories in this
repository have to be flattened on the way in. The directory name becomes the command you
type.

| Scope | Path | Applies to |
|---|---|---|
| Personal | ~/.claude/skills/<name>/SKILL.md | every project on your machine |
| Project | .claude/skills/<name>/SKILL.md | that repository, and anyone who clones it |

against the Claude Code skills documentation on 2026-07-28:
<

Install a few skills

Recommended. Pick what the project actually needs.

Then /owasp, /common-pitfalls, /publish-safety. Each skill's description frontmatter
also lets Claude load it on its own when the work matches - writing a query, adding an upload
endpoint, pushing a branch.

Install all 47

skills/shared/ is excluded deliberately: it holds cross-cutting checklists, prompts, and
references, not skills, and its only SKILL.md is the authoring scaffold.

Directory names are unique across all four categories, so flattening needs no renaming. Check
for collisions with skills you already have - same name means the personal copy wins over a
project one, and any of them o a bundled skill of that name.

Symlink instead of copy

Keeps one checkout as the source of truth, so git pull updates every installed skill:

Claude Code follows the symlink and reads SKILL.md from the target. This also preserves the
handful of cross-skill relati - publish-safety/SKILL.md points at
../common-pitfalls/references/secret-exposure.md, which resol the checkout but
dangles after a flat copy of only one of the two.

Per-project, committed

Committing the skill is how teammates and cloud sessions get it. Personal skills under
~/.claude/skills/ are local to your machine and are not read by Cowork or cloud sessions.
A project skill's allowed-tools only takes effect after you accept the workspace trust
dialog, which is the point at which you should have read what you are trusting.

Confirm it worked

Run /skills in Claude Code and look for the names you installed. Adding or editing a skill
inside an existing skills directory is picked up mid-session; creating the top-level
~/.claude/skills/ or .claude/skills/ directory for the first time needs a restart before
it is watched.

Worth knowing before you install all of them

Every installed skill costs context at startup. Only the description is loaded until a

skill is used, but 47 descriptions is roughly 17 KB of every session. Installing the three
or four that match the project beats installing the set.

The frontmatter is Claude Code specific and inert elsewhere. allowed-tools is deliberately

narrow: read, search, and web lookup only. Nothing here needs write access or arbitrary shell
access to do its job.

This is guidance, not a scanner. Installing 47 skills does not add a security gate. See

Limitations.

Other assistants

The Markdown works anywhere. The YAML frontmatter (allowed-tools, name, description) is
Claude Code specific and is silently ignored by every other tool.

One-liner install (any platform that supports bash):

Per-platform setup:

| Platform | Where to put the skills | How |
|---|---|---|
| Cursor | .cursor/rules/ | Copy each SKILL.md as <name>.mdc, or add AI_INSTRUCTIONS.md as a global rule |
| Windsurf | .windsurf/rules/ | Same as Cursor - one .md file per skill |
| GitHub Copilot | .github/copilot-instructions.md | Paste the routing table from AI_INSTRUCTIONS.md |
| Kiro | .kiro/steering/ | Copy AI_INSTRUCTIONS.md as security.md; add skill files as needed |
| Roo Code / Kilocode | .roo/rules/ or .kilocode/rules/ | Copy AI_INSTRUCTIONS.md as a rule file |
| Codex CLI | AGENTS.md in project root | Append the registry section from AI_INSTRUCTIONS.md |
| Gemini CLI | GEMINI.md in project root | Same approach as Codex |
| Continue | .continue/rules/ | One Markdown file per skill, or a single combined file |
| Warp | .warp/ agent rules | Reference AI_INSTRUCTIONS.md as context |
| Augment | Project context settings | Add AI_INSTRUCTIONS.md as a context source |

For any tool not listed: point it at AI_INSTRUCTIONS.md first. That file is the routing table
and output contract. Load indi SKILL.md files on demand - loading all 47 at once will
saturate the context window of most tools.

Using it

Scope the request and name the standard. Vague prompts produce category recitals; specific
prompts produce findings.

That last sentence is the useful part. Asking for an exploitation path is what separates a
from a code smell, and it stops the assistant padding the list.

Before accepting generated code:

Design review is cheaper than code review:

More, including the anti-patterns worth a, in
skills/core/owasp/prompts.md.

Layout

The split between README.md and AI_INSTRUCTIONS.md is deliberate. Humans want to know
what this is and whether it is worth using; an assistant wants a routing table and a set of
rules. Mixing the two makes both worse, and makes the AI-facing part hard to grow as skills
accumulate.

Standards

Pinned with the date each was against its source, because category IDs mo
editions and a stale ID is worse than no ID.

| Standard | | | Source |
|---|---|---|---|
| OWASP Top 10 | 2025 | 2026-07-28 | < |
| OWASP API Security Top 10 | 2023 | 2026-07-28 | < |
| OWASP ASVS | 5.0.0 (released 2025-05-30) | 2026-07-28 | < |

Each serves a different purpose, and the skill says which to reach for:

Top 10 - risk triage, and talking to people who are not security specialists

API Security Top 10 - anything with an API surface, where object-le

dominates

ASVS - . Concrete, testable requirements, organised in chapters

Top 10 tells you what usually goes wrong. AS you what to check.

If you are carrying o written against the 2021 Top 10, read
the 2025 reference first. It is not a
renumbering: two categories are new and Injection moved.

Limitations

Worth being direct about, because a security tool that o itself is a liability.

Guidance, not a scanner. No dataflow analysis. Anything needing cross-file taint

tracking will be missed. Pair this with SAST, do not replace it.

Reading code cannot confirm runtime configuration. A correct control that is disabled in

production still reads as correct here.

AS is chapter-level (), not indi requirement IDs. Formal ASVS

needs the official CSV.

Compliance mapping is engineering guidance, not certification. The

enterprise/compliance skill maps technical controls to e for ISO 27001, SOC 2,
PCI DSS, HIPAA, and GDPR. It does not replace legal advice, an auditor, or the official
framework text.

Example languages are Python, TypeScript, Ja, Java, and PHP. The patterns

generalise; the syntax does not.

Security notes

The skills contain deliberately code, used to show what a fix is fixing. Every such
block is labelled : and paired with a corrected . Do not copy a
labelled- block into a project.

All examples use placeholder . No real credentials, hostnames, keys, or personal data
anywhere in this repository.

Contributing

A new skill matches the file shape above and clears the bar core/owasp sets:

Every control cites a standard - Top 10 category, AS, and CWE where one applies

Every pattern shows and fixed code, and explains why the fix closes the hole

rather than just looking safer

Limitations are stated. A control with a known gap says so

claims carry the source URL and the date checked

Nothing is in. An un requirement number is left out, not guessed

Start from skills/shared/templates/ and read
skills/core/owasp/ first - the shape is easier to match than to
describe. Update catalog/skills.json, run
python scripts/.py, then update the registry, graph, matrix, status table,
and CHANGELOG.md. See CONTRIBUTING.md, MAINTENANCE.md,
SECURITY.md, and docs/ADOPTION.md. The adoption guide also
lists companion controls the toolkit does not replace and provides
threat-model and
security-design-review templates.

References

OWASP Top 10 2025 - <

OWASP API Security Top 10 2023 - <

OWASP ASVS - <

OWASP Cheat Sheet Series - <

CWE Top 25 - <

NIST SSDF (SP 800-218) - <

License

MIT. See LICENSE.

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Security-focused Markdown skills for AI coding assistants, with OWASP-mapped guidance, checklists, secure patterns, and defensive examples.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。