skills.rest
rocklambros
rocklambrosCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

scaffolding-security-research-repo

Scaffold empty security-research repositories with governance, disclosure, and hardening files.

2|Updated May 23, 2026
Search Tags:#security#scaffolding#pre-commit#semgrep#gitleaks#threat model#vulnerability disclosure
One-click install
npx skills add https://github.com/rocklambros/rcs --skill scaffolding-security-research-repo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scaffolding-security-research-repo
Source: https://github.com/rocklambros/rcs/tree/main/skills/workflow/scaffolding-security-research-repo
Command: npx skills add https://github.com/rocklambros/rcs --skill scaffolding-security-research-repo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill prevents security-research projects from starting without the governance and hardening files they need, so teams do not discover later that they have no disclosure policy, no reporting path, and no baseline protections in place.

Core Features & Use Cases

  • Greenfield security scaffolding: Creates the core repository artifacts for a new security-research, AI-security, red-team, defensive-tooling, vulnerability-research, or threat-modeling project.
  • Disclosure and safety setup: Adds SECURITY.md, VDP.md, CONTRIBUTING.md, and a starter threat model with safe-harbor language and coordinated-disclosure guidance.
  • Supply-chain and secret hygiene: Wires gitleaks, semgrep, and ruff into pre-commit and adds a security-focused .gitignore that covers payloads, exploit binaries, credential dumps, and similar artifacts.
  • Use case: A researcher starting a public tool for adversarial testing can use this Skill to generate the full repo structure from an empty directory instead of assembling policy files, hooks, and templates by hand.

Quick Start

Ask Claude to scaffold a new empty security-research repository for your project with SECURITY.md, VDP.md, a starter threat model, gitleaks and semgrep pre-commit hooks, and a security-focused .gitignore.

Frequently Asked Questions about scaffolding-security-research-repo

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scaffold a new security research repository with disclosure and pre-commit hooks?▼

To scaffold a security research repository, you can generate core governance files like SECURITY.md and VDP.md, alongside gitleaks and semgrep pre-commit hooks, directly from an empty directory.

What files do I need for a vulnerability disclosure policy in a greenfield security project?▼

A vulnerability disclosure policy requires SECURITY.md, VDP.md, and CONTRIBUTING.md files with safe-harbor language and coordinated-disclosure guidance to establish clear reporting paths for security research projects.

Can I add semgrep and gitleaks pre-commit hooks to an existing mature security project?▼

No, this scaffolding process applies only to empty directories and refuses to overwrite mature projects or non-security work, ensuring existing repository structures remain protected from automated file generation.

What is the best way to set up a threat modeling project repository from scratch?▼

The best way to set up a threat modeling project is to generate a starter threat model, security-focused .gitignore, and supply-chain hygiene configurations automatically within an empty directory.

Does this scaffolding support AI red team and offensive tool repositories?▼

Yes, the scaffolding supports AI-red-team work, offensive tools, defensive tools, research corpora, and vulnerability research projects by producing the required hardening and governance artifacts for each context.

Why should I include a security-specific .gitignore in my vulnerability research repo?▼

A security-specific .gitignore prevents accidentally committing exploit binaries, payload files, and credential dumps to your vulnerability research repository, ensuring sensitive artifacts remain excluded from version control.

Related Skills

Explore More Software Engineering Skills→
danhannah94danhannah94

csdlc-bootstrap

Generate CSDLC workflow, design-doc scaffolding, and governance artifacts for existing projects.

Community
Advanced
saschadudkin-sketchsaschadudkin-sketch

semgrep-gitleaks-security-ci

Detect secrets and vulnerabilities in code repositories with semgrep and gitleaks.

Community
Advanced
Brennan-WilkersonBrennan-Wilkerson

security-audit

Automate security audits of code repositories using Gitleaks and Trufflehog.

Community
Advanced
AstrumonAstrumon

commit

Create standardized Git commits with validated type: description messages.

Community
Intermediate