Security Planning
Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding.
Install
$ agentstack add skill-microsoft-hve-core-security-planning ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-microsoft-hve-core-security-planning) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Security Planning
This skill packages the durable security-planning reference material used by the Security Planner: operational bucket guidance, STRIDE analysis patterns, standards cross-references, NIST control-family references, and security-specific backlog formats.
When to use
Use this skill when you need to:
- Classify application components into the operational security buckets used during planning.
- Evaluate threats with STRIDE-based analysis, including AI-specific extensions when
raiEnabledis true. - Map bucket findings to standards references and control families without re-embedding long standard tables.
- Derive security-specific backlog priorities and RAI work item categories for Phase 5 handoff.
Skill layout
Load the reference file that matches the phase or topic you need.
| Reference | Topic | |------------------------------------------------------------------------------------|-------------------------------------------------------------------------| | [references/00-index.md](references/00-index.md) | Navigation catalog and consolidated attribution | | [references/operational-buckets.md](references/operational-buckets.md) | Operational bucket definitions, GS overlay, and classification guidance | | [references/stride-model.md](references/stride-model.md) | STRIDE methodology, AI extensions, risk matrix, and data-flow analysis | | [references/standards-cross-reference.md](references/standards-cross-reference.md) | Bucket-to-standards mapping table and component mapping output format | | [references/nist-control-families.md](references/nist-control-families.md) | NIST 800-53 priority tiers and NIST AI RMF subcategory mappings | | [references/backlog-formats.md](references/backlog-formats.md) | Security-specific prioritization and RAI work item categories |
Attribution
The durable reference content in this skill is organized by reference file and summarized in [references/00-index.md](references/00-index.md). See that index for the consolidated attribution and delegation notes.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: microsoft
- Source: microsoft/hve-core
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.