# Security Skills

A collection of security-focused skills for AI coding assistants such as Claude Code, Cursor and Copilot, from Red Hat's product security team, encoding security recommendations and practices as structured Markdown files an assistant reads while writing, testing or auditing code.

Security Skills packages security guidance, such as input and output sanitization, fuzzing harness construction, or differential review of a diff's security impact, as tool-agnostic Markdown skill files that any assistant able to read a file can follow, referenced in a prompt by path, for example asking an assistant to review an MCP server for injection risks using a named skill file. The intent is to apply security guidance during development rather than only during a later review.

Skills can be installed into an assistant with a companion tool called Lola, or cloned directly into a container image at build time for platforms that bake knowledge into runner images and expose it through a directory-inclusion mechanism, with the module's own top-level file serving as the single entry point listing all of its skills and their triggers. The project's own development setup wires up linting and architecture-decision-record validation as git hooks.

It is written in Python and licensed under Apache-2.0.

Website: https://github.com/RedHatProductSecurity/prodsec-skills