将结构化的安全技能融入你的AI编码代理。获得即时、基于框架的安全专业知识。

---

为什么会有这样的存在

AI编码代理可以执行安全审查，但它们会误以为框架控制数值过高，漏掉整个漏洞类别，并且在多次运行中输出不一致。结果是听起来权威，但经过仔细审视反而失效的安全指导。

这些技能将代理扎根于真实发布的框架中——OWASP、NIST、MITRE ATT&CK 和 CIS Controls——以确保每个发现都对应到可验证的控制点。它们不是提示转储。它们是结构化、框架引用、注入加固的技能文件，能够产生可靠且可审计的安全输出。

快速启动

Claude 代码（原生格式 — 自动发现和 /slash-commands）

双子座CLI

光标

Codex CLI / Kiro / Generic

每个技能是一个目录，入口点为SKILL.md，遵循代理技能开放标准。Claude Code 自动发现技能;其他工具可以按路径加载技能。

技能赛制

每个技能都有一个目录，位于skills/ / /，目录中有“SKILL”。

Security Skills for AI Coding Agents

Drop structured security skills into your AI coding agent. Get instant, framework-grounded security expertise.

---

Why This Exists

AI coding agents can perform security reviews, but they hallucinate framework control numbers, miss entire vulnerability categories, and produce inconsistent output across runs. The result is security guidance that sounds authoritative but falls apart under scrutiny.

These skills ground agents in real published frameworks – OWASP, NIST, MITRE ATT&CK, and CIS Controls – so that every finding maps to a verifiable control. They are not prompt dumps. They are structured, framework-referenced, injection-hardened skill files that produce reliable, auditable security output.

Quick Start

git clone https://github.com/UnitOneAI/SecuritySkills.git
cd SecuritySkills

Claude Code (native format — auto-discovery and /slash-commands)

# Global install — all skills available via auto-discovery and /skill-name
cp -r skills/*/* ~/.claude/skills/

# Or project-local
mkdir -p .claude/skills && cp -r skills/*/* .claude/skills/

# Then use naturally:
# "Review this code for security issues"    → Claude auto-loads secure-code-review
# /threat-modeling                          → Direct invocation
# /cve-triage CVE-2024-1234                 → With arguments

Gemini CLI

# Reference skills via @ commands
cp -r skills/ ~/.gemini/skills/

Cursor

# Add as Cursor rules
cp -r skills/ .cursor/rules/

Codex CLI / Kiro / Generic

# Point any agent at a skill's SKILL.md file
codex --context skills/appsec/threat-modeling/SKILL.md "Review this design"
kiro spec --skill skills/ai-security/llm-top-10/SKILL.md

Each skill is a directory with SKILL.md as the entrypoint, following the Agent Skills open standard. Claude Code discovers skills automatically; other tools can load them by path.

Skill format

Every skill is a directory at skills/// with SKILL.md as the entrypoint, following the Agent Skills open standard.

SKILL.md frontmatter

All skills use the same YAML frontmatter fields:

name: threat-modeling                 # kebab-case, matches the directory
description: >                        # what it does + when it auto-invokes