scaffolding-security-research-repo

What problem does it solve?

This Skill prevents security-research projects from starting without the governance and hardening files they need, so teams do not discover later that they have no disclosure policy, no reporting path, and no baseline protections in place.

Core Features & Use Cases

• Greenfield security scaffolding: Creates the core repository artifacts for a new security-research, AI-security, red-team, defensive-tooling, vulnerability-research, or threat-modeling project.
• Disclosure and safety setup: Adds SECURITY.md, VDP.md, CONTRIBUTING.md, and a starter threat model with safe-harbor language and coordinated-disclosure guidance.
• Supply-chain and secret hygiene: Wires gitleaks, semgrep, and ruff into pre-commit and adds a security-focused .gitignore that covers payloads, exploit binaries, credential dumps, and similar artifacts.
• Use case: A researcher starting a public tool for adversarial testing can use this Skill to generate the full repo structure from an empty directory instead of assembling policy files, hooks, and templates by hand.

Quick Start

Ask Claude to scaffold a new empty security-research repository for your project with SECURITY.md, VDP.md, a starter threat model, gitleaks and semgrep pre-commit hooks, and a security-focused .gitignore.