skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

security-reviewer-formats

Defines report templates and data contracts for security review orchestrators and subagents.

1.4k|284|Updated Nov 2, 2025
Search Tags:#owasp#vulnerability assessment#security review#rai#data contracts#report templates#Multi-Agent
One-click install
npx skills add https://github.com/microsoft/hve-core --skill security-reviewer-formats
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-reviewer-formats
Source: https://github.com/microsoft/hve-core/tree/main/.github/skills/security/security-reviewer-formats
Command: npx skills add https://github.com/microsoft/hve-core --skill security-reviewer-formats

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Security, accessibility, and RAI review workflows involve multiple orchestrators and subagents exchanging findings, verdicts, and reports; without shared format contracts, these exchanges become inconsistent and error-prone. This Skill centralizes the canonical templates and serialization formats so every agent in the pipeline produces and consumes identical structures.

Core Features & Use Cases

  • Report Templates: Provides VULN_REPORT_V1, PLAN_REPORT_V1, and RAI_REPORT_V1 templates covering audit, diff, and plan modes with exact section layouts and placeholder semantics.
  • Finding Exchange Formats: Defines finding serialization, deep verification verdict blocks, and verified findings collection formats for inter-subagent data exchange.
  • Completion and Severity Contracts: Standardizes scan status updates, completion summaries, terminal error codes, and CRITICAL/HIGH/MEDIUM/LOW severity definitions shared across all OWASP assessments.
  • Use Case: When building a security review orchestrator that dispatches assessment subagents and a report generator, load these references so the verifier emits RAI_DEEP_VERIFICATION_V1 verdicts and the generator writes a compliant RAI_REPORT_V1 with correct path validation and retry rules.

Quick Start

Load the security reviewer format references and generate a vulnerability report that follows the VULN_REPORT_V1 template for the current repository audit.

Frequently Asked Questions about security-reviewer-formats

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I format a security assessment report for audit mode?▼

Use the VULN_REPORT_V1 template, which defines the header block, executive summary, summary counts, severity breakdown, verification summary, findings by framework, remediation guidance, and checklist sections. Diff mode adds a scope field and a changed files appendix.

What format do subagents use to exchange security findings?▼

Findings are serialized as markdown blocks with ID, Title, Status, Severity, Location, Finding, and Recommendation fields. Verified findings collections group items by skill, with FAIL and PARTIAL items carrying the full deep verification verdict block.

How does plan mode reporting differ from audit mode?▼

Plan mode uses PLAN_REPORT_V1 with RISK, CAUTION, COVERED, and NOT_APPLICABLE statuses instead of PASS/FAIL verdicts, and contains no verification summary. It focuses on theoretical risks in a plan document with mitigation guidance rather than confirmed vulnerabilities.

What severity levels are used in OWASP skill assessments?▼

Four standard levels are defined: CRITICAL for immediate full compromise, HIGH for minimal-prerequisite significant impact, MEDIUM for condition-dependent meaningful degradation, and LOW for difficult exploitation or limited scope.

Which terminal errors can be retried in RAI report generation?▼

Only REPORT_WRITE_FAILED is retryable, and it may retry once. All other terminal contract errors such as INVALID_PAYLOAD, MALFORMED_VERDICT, and HUMAN_ACCEPTANCE_VIOLATION stop the pipeline immediately.

Related Skills

Explore More Software Engineering Skills→
yibeichanyibeichan
1

cso

Map application attack surfaces and assess OWASP Top 10 risks.

Community
Advanced
dnvitidnviti
10

vulnerability-create

Generate structured remediation tasks from security vulnerability findings with severity classification.

Community
Intermediate
lushly-devlushly-dev
4

audit-security

Audit web applications, APIs, MCP servers, and AI agents for OWASP/CWE vulnerabilities.

Official
Advanced
oto1720oto1720
1

isomorphism-check

Verify code changes match established structural patterns across languages.

Community
Intermediate