writing-security-skills

To document reusable security skills from baseline testing failures, you draft a minimal SKILL.md file capturing the observed attack methodology gaps, ensuring it meets the 1024 character minimum and YAML frontmatter constraints. This approach eliminates ad-hoc documentation by standardizing how engagement failures are recorded.

The red-green-refactor workflow for security skill creation is a validation process that guides development with testing discipline. You identify a failing baseline, draft a minimal skill addressing the gap, and run a refactor to close new shortcuts, ensuring the skill is testable before deployment.

To structure a SKILL.md file for cross-references and flow routing, you include YAML frontmatter with name and description fields, detail triggering conditions and target types, and use optional folders like scripts, references, and assets to organize supporting components.

Yes, you can use security skills across different engagement techniques and methodologies. The skills are designed to align with engagement workflows, detailing specific triggering conditions, target types, and tool flows so they slot directly into routing systems.

No specific dependencies are required to create standardized security skills. The process relies on capturing attack methodology gaps uncovered during baseline testing and drafting a minimal skill to address those observed gaps without external tool dependencies.