cosai-oasis

Audit framework mappings — an existing entity's mappings, the whole corpus, or a candidate value proposed for an entity not yet in the corpus — against the framework mappings style guide. Use when reviewing, auditing, or pre-PR authoring mapping changes for…

Audit persona identification questions in personas.yaml against the identification questions style guide. Use when reviewing or proposing changes to identificationQuestions.

Check whether a CoSAI Risk Map entry is pitched at the right altitude (granularity). For a control: objective-not-implementation, not-a-restated-risk, posture-not-mandate, solved-problem, no-duplication. For a risk: the merge-vs-distinct two-test,…

Select the structured references and framework mappings for a CoSAI Risk Map control or risk — for a control: which components it applies to, which risks it addresses, and which mappings (MITRE ATLAS mitigations, NIST AI RMF subcategories, OWASP LLM) fit; for…

Ground CoSAI Risk Map terminology in established security terms of art. Use when authoring or critiquing a Control, Risk, Component, or Persona title or description to check a proposed term against the canonical (NIST-first) vocabulary, replace an invented…

A CodeGuard security skill that helps AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.

Guide secure migration of code from memory-unsafe languages (C, C++, Assembly) to memory-safe languages (Rust, Go, Java, C#, Swift). Use when migrating or rewriting legacy C/C++ code, designing FFI boundaries between safe and unsafe code, writing new modules…

Comprehensive security code review workflow for a target repository, producing a markdown report with findings and recommendations.

Instructs AI coding agents to invoke CodeGuard MCP Server security rules before writing or reviewing code.

CoSAI WS4 only — draft an agenda for a WS4 or ADLC meeting from the previous agenda, recent minutes, and open issues/PRs. Summon by name in the ws4-secure-design-agentic-systems repo.

CoSAI WS4 only — draft a structured triage note for a WS4/ADLC issue or PR in @parmarmanojkumar's house format. Summon by name in the ws4-secure-design-agentic-systems repo.