Menu
Apply OWASP MAESTRO, MITRE ATLAS, NIST AI RMF, and ISO 42001/23894 security frameworks to MAS designs
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Verify an external or AI-generated security report against the actual codebase before acting on it. Use when handed a scanner PDF, automated teardown, audit report, or bug-bounty submission — classifies every finding CONFIRMED / OVERSTATED / FALSE-POSITIVE / FABRICATED and salvages the real work items.
Creates GitHub Actions for the Marketplace. Use when scaffolding a new action, implementing composite steps, writing BATS tests, or preparing a Marketplace release.
Audit documentation against its declared hierarchy — broken links, duplicates, misplaced content, stale references, single-source-of-truth enforcement. Use for doc health reviews.
Audit README.md files against best practices for repos, accounts, or orgs. Detects missing sections, stale links, inconsistent formatting, and convention violations. Use when reviewing README quality across one or many repos.
Generate or update README.md files across three scopes — repo (with project-type detection), account (GitHub user profile), and org (organization profile). Use when creating, updating, or aligning a README to org conventions.
Audits website accessibility for WCAG 2.2 AA compliance, generating findings and code fixes. Use when reviewing accessibility, keyboard navigation, screen reader compatibility, or inclusive design.
| name | securing-mas |
| description | Apply OWASP MAESTRO, MITRE ATLAS, NIST AI RMF, and ISO 42001/23894 security frameworks to MAS designs |
| compatibility | Designed for Claude Code |
| metadata | {"allowed-tools":"Read, Grep, Glob, WebSearch, WebFetch","argument-hint":["component-or-feature"],"stability":"stable","content-hash":"sha256:94039e17e94bb06a07cb298b68d4b5a02f3ef882ad08837656d1a82d3e0ad8b2","last-verified-cc-version":"1.0.34"} |
Target: $ARGUMENTS
Trigger this skill when:
MITRE ATLAS (attack taxonomy — what adversaries do)
| informs threat identification
v
OWASP MAESTRO (threat model — what to defend against in MAS)
| maps threats to controls
v
NIST AI RMF (risk framework — how to govern/map/measure/manage)
| operationalized by
v
ISO 42001 + 23894 (certifiable management system + risk methodology)
Use all four layers together: ATLAS enumerates attack vectors, MAESTRO maps them to MAS-specific controls, NIST AI RMF structures governance, and ISO provides the certifiable management system.
Review the framework stack — references/mas-security.md for the conceptual overview of MAESTRO, ATLAS, NIST AI RMF, and ISO 42001/23894 layers working together.
Apply the 7-layer security check — for each new component, walk through every MAESTRO layer. See references/maestro-7-layer-checklist.md for the actionable per-layer checklist (Model → Orchestration).
Run the plugin security checklist — before marking an implementation complete, verify input validation, output safety, resource management, observability, and external dependencies. See references/plugin-security-checklist.md.
Document threats in the cross-framework matrix — for each feature, map concerns to ATLAS techniques, MAESTRO layers, NIST functions, and ISO controls. Start from references/threat-matrix-template.md and add feature-specific rows.
Avoid common vulnerability patterns — consult references/common-vulnerabilities.md for vulnerable/secure code examples: prompt injection (L1), type confusion (L2), resource exhaustion (L5), secret leakage (L6).
Test security controls explicitly — write tests that exercise each MAESTRO layer's controls. See references/security-testing-patterns.md for pytest examples (input validation, timeout enforcement, error message safety).