AutoGineer
Generated banner for Security Reviewer Formats
Generated logo for Security Reviewer Formats

Security Reviewer Formats

MicrosoftOfficialPublished by Microsoft

  • Skill
  • Guidelines
  • Software development
  • MIT
  • No issues found
Download ZIP

From the author

Format specifications and data contracts for the security reviewer orchestrator and its subagents.
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a centralized repository of format specifications and data contracts designed for security review orchestrators and their subagents. It ensures consistency across the reporting pipeline by defining standardized structures for vulnerability findings, scan status updates, completion summaries, and severity definitions. By establishing these shared schemas, the skill enables reliable data exchange between different components of the assessment process, including audit, diff, and plan modes.

What it does

  • Defines standardized templates for vulnerability, plan, and RAI reports.
  • Specifies serialization formats for security and RAI findings.
  • Provides consistent status update and completion report structures.
  • Establishes uniform severity level definitions for OWASP assessments.
  • Defines data contracts for inter-subagent communication and verification results.

When to use it

  • When developing or configuring subagents for a security review orchestration system.
  • When implementing new reporting modules that must integrate with existing assessment workflows.
  • When standardizing the output format of security scans across different assessment modes.
  • When ensuring consistent severity and status reporting across multiple security skills.

Advantages

  • Ensures interoperability between different subagents and the main orchestrator.
  • Provides a single source of truth for reporting and finding schemas.
  • Facilitates consistent data exchange and verification processes.
  • Simplifies the integration of new security assessment skills into the existing framework.

Usage examples

“What is the required format for a vulnerability finding serialization?”
The agent provides the specific markdown structure including ID, Title, Status, Severity, Location, Finding, and Recommendation fields.
“How should a scan completion report be structured for an audit mode assessment?”
The agent returns the template containing the report path, mode, skills assessed, severity counts, verification statistics, and summary counts.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/microsoft/security-reviewer-formats/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip security-reviewer-formats.zip -d .agents/skills

Documentation by Microsoft

Security Reviewer Formats — Skill Entry

This SKILL.md is the entrypoint for the security reviewer format specifications skill.

The skill provides shared format templates and data contracts used by security, accessibility, and RAI review orchestrators and their subagents. Each reference file covers a focused area of the reporting pipeline.

Normative references

  1. Report Formats — VULN_REPORT_V1, PLAN_REPORT_V1, and RAI_REPORT_V1 templates.

  2. Finding Formats — Security and RAI finding, verification, and collection formats.

  3. Completion Formats — Scan status, completion, RAI response, and terminal error formats.

  4. Severity Definitions — Standard severity level definitions for all OWASP skill assessments.

Skill layout

  • SKILL.md — this file (skill entrypoint).

  • references/ — format specification documents.

    • report-formats.md — full report templates for audit, diff, and plan modes.

    • finding-formats.md — serialization and collection formats for findings exchange between subagents.

    • completion-formats.md — status updates, completion summaries, and the minimal profile stub.

    • severity-definitions.md — severity level table shared across all assessments.

Files

LICENSE

# MIT License

Copyright (c) Microsoft Corporation. All rights reserved.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/hve-core · .github/skills/security/security-reviewer-formats · commit f425e94
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download security-reviewer-formats.zip