# Security Planning

> Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding.

- **Type:** Skill
- **Install:** `agentstack add skill-microsoft-hve-core-security-planning`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [microsoft](https://agentstack.voostack.com/s/microsoft)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [microsoft](https://github.com/microsoft)
- **Source:** https://github.com/microsoft/hve-core/tree/main/.github/skills/project-planning/security-planning

## Install

```sh
agentstack add skill-microsoft-hve-core-security-planning
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Planning

This skill packages the durable security-planning reference material used by the Security Planner: operational bucket guidance, STRIDE analysis patterns, standards cross-references, NIST control-family references, and security-specific backlog formats.

## When to use

Use this skill when you need to:

* Classify application components into the operational security buckets used during planning.
* Evaluate threats with STRIDE-based analysis, including AI-specific extensions when `raiEnabled` is true.
* Map bucket findings to standards references and control families without re-embedding long standard tables.
* Derive security-specific backlog priorities and RAI work item categories for Phase 5 handoff.

## Skill layout

Load the reference file that matches the phase or topic you need.

| Reference                                                                          | Topic                                                                   |
|------------------------------------------------------------------------------------|-------------------------------------------------------------------------|
| [references/00-index.md](references/00-index.md)                                   | Navigation catalog and consolidated attribution                         |
| [references/operational-buckets.md](references/operational-buckets.md)             | Operational bucket definitions, GS overlay, and classification guidance |
| [references/stride-model.md](references/stride-model.md)                           | STRIDE methodology, AI extensions, risk matrix, and data-flow analysis  |
| [references/standards-cross-reference.md](references/standards-cross-reference.md) | Bucket-to-standards mapping table and component mapping output format   |
| [references/nist-control-families.md](references/nist-control-families.md)         | NIST 800-53 priority tiers and NIST AI RMF subcategory mappings         |
| [references/backlog-formats.md](references/backlog-formats.md)                     | Security-specific prioritization and RAI work item categories           |

## Attribution

The durable reference content in this skill is organized by reference file and summarized in [references/00-index.md](references/00-index.md). See that index for the consolidated attribution and delegation notes.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [microsoft](https://github.com/microsoft)
- **Source:** [microsoft/hve-core](https://github.com/microsoft/hve-core)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-microsoft-hve-core-security-planning
- Seller: https://agentstack.voostack.com/s/microsoft
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.