cosai-oasis

Audit persona identification questions in personas.yaml against the identification questions style guide. Use when reviewing or proposing changes to identificationQuestions.

Audit all framework mappings in risks.yaml, controls.yaml, and personas.yaml against the framework mappings style guide. Use when reviewing or proposing changes to mappings sections.

Check whether a CoSAI Risk Map entry is pitched at the right altitude (granularity). For a control: objective-not-implementation, not-a-restated-risk, posture-not-mandate, solved-problem, no-duplication. For a risk: the merge-vs-distinct two-test,…

Select the structured references and framework mappings for a CoSAI Risk Map control or risk — for a control: which components it applies to, which risks it addresses, and which mappings (MITRE ATLAS mitigations, NIST AI RMF subcategories, OWASP LLM) fit; for…

Ground CoSAI Risk Map terminology in established security terms of art. Use when authoring or critiquing a Control, Risk, Component, or Persona title or description to check a proposed term against the canonical (NIST-first) vocabulary, replace an invented…

A CodeGuard security skill that helps AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.

Guide secure migration of code from memory-unsafe languages (C, C++, Assembly) to memory-safe languages (Rust, Go, Java, C#, Swift). Use when migrating or rewriting legacy C/C++ code, designing FFI boundaries between safe and unsafe code, writing new modules…

Comprehensive security code review workflow for a target repository, producing a markdown report with findings and recommendations.

Instructs AI coding agents to invoke CodeGuard MCP Server security rules before writing or reviewing code.

CoSAI WS4 only — draft an agenda for a WS4 or ADLC meeting from the previous agenda, recent minutes, and open issues/PRs. Summon by name in the ws4-secure-design-agentic-systems repo.

CoSAI WS4 only — draft a structured triage note for a WS4/ADLC issue or PR in @parmarmanojkumar's house format. Summon by name in the ws4-secure-design-agentic-systems repo.