A security skill pack for AI coding agents. Drop it into any project to give your agent secure coding instincts — behavioral guardrails, OWASP-aligned rules for code and LLM apps, infrastructure hardening, and static analysis guidance.
Built by Prismor. For live threat intelligence and runtime enforcement, see prismor.
Add this to your project's CLAUDE.md:
At the start of every session, read `https://raw.githubusercontent.com/PrismorSec/security-playbook/main/security.md` and follow its instructions.That's it. Your agent will load behavioral guardrails, OWASP secure coding rules, and LLM security guidance automatically.
For Cursor/Windsurf, add the same line to .cursorrules or .windsurfrules.
| Skill | What it does |
|---|---|
behavioral-security/ |
Guardrails the agent enforces on itself — blocks destructive commands, protects secrets, resists prompt injection |
code-security/ |
OWASP Top 10 secure coding rules across Python, JS, Go, Java, C/C++, plus Docker, K8s, Terraform |
llm-security/ |
OWASP Top 10 for LLM Applications 2025 — prompt injection, excessive agency, data poisoning, RAG security |
static-analysis/ |
How to run scans, write custom Semgrep rules, and enforce patterns in CI |
semgrep/ |
Ready-to-use Semgrep rule configurations |
The single entry point is security.md — point your agent there and it will load what it needs.
Add to your project's CLAUDE.md:
At the start of every session, read the raw `security.md` from the security-playbook repo and follow its instructions:
https://raw.githubusercontent.com/PrismorSec/security-playbook/main/security.mdOr if you've cloned the repo locally:
At the start of every session, read `<path-to-security-playbook>/security.md` and follow its instructions.Add to .cursorrules or .windsurfrules:
Before writing or reviewing code, read the security playbook:
https://raw.githubusercontent.com/PrismorSec/security-playbook/main/security.md
## Security
All agents must read and follow the Security Playbook before writing or reviewing code:
https://raw.githubusercontent.com/PrismorSec/security-playbook/main/security.md
Key skills:
- [Behavioral Guardrails](https://raw.githubusercontent.com/PrismorSec/security-playbook/main/behavioral-security/SKILL.md)
- [Code Security](https://raw.githubusercontent.com/PrismorSec/security-playbook/main/code-security/SKILL.md)
- [LLM Security](https://raw.githubusercontent.com/PrismorSec/security-playbook/main/llm-security/SKILL.md)
- [Static Analysis](https://raw.githubusercontent.com/PrismorSec/security-playbook/main/static-analysis/SKILL.md)Each skill directory includes a skill.json compatible with the OpenClaw skill format. Point your skill server at this repo root.
Guardrails the agent enforces on itself during any session:
- Deny-list: Blocks
rm -rf /, fork bombs, blindcurl | bash, privilege escalation - Secret protection: Never reads or transmits
~/.ssh/*,~/.aws/credentials,.envfiles, etc. - Human-in-the-loop: Requires confirmation before global installs, DB drops, cloud deployments, or mass file overwrites
- Anti-prompt injection: Treats
"Ignore previous instructions"and similar patterns as attacks, not instructions
OWASP Top 10 rules with vulnerable/secure code examples across languages:
Critical: SQL Injection, Command Injection, XSS, Path Traversal, Hardcoded Secrets, XXE, Insecure Deserialization, Code Injection, Memory Safety
High: Insecure Crypto, SSRF, Insecure Transport, JWT Issues, CSRF, Prototype Pollution, Unsafe Functions
Infrastructure: AWS/Azure/GCP Terraform, Kubernetes manifests, Dockerfiles, GitHub Actions workflows
OWASP Top 10 for LLM Applications 2025:
| # | Vulnerability | Severity |
|---|---|---|
| LLM01 | Prompt Injection | CRITICAL |
| LLM02 | Sensitive Information Disclosure | CRITICAL |
| LLM03 | Supply Chain | CRITICAL |
| LLM04 | Data and Model Poisoning | CRITICAL |
| LLM05 | Improper Output Handling | CRITICAL |
| LLM06 | Excessive Agency | HIGH |
| LLM07 | System Prompt Leakage | HIGH |
| LLM08 | Vector and Embedding Weaknesses | HIGH |
| LLM09 | Misinformation | MEDIUM |
| LLM10 | Unbounded Consumption | HIGH |
Guidance for running Semgrep (and similar) scans and writing custom detection rules:
- Pattern matching vs. taint/dataflow mode — when to use each
- Custom rule authoring with positive and negative test cases
- SARIF/JSON output for CI integration
- How static analysis complements the playbook's code-security rules
The playbook provides agent-readable guidance. For runtime hook enforcement, session telemetry, and advisory correlation, see Prismor Warden:
python3 warden/cli.py install-hooks --agent all --mode enforce
python3 warden/cli.py sessions- New rules go in the appropriate skill directory with a Markdown file under
rules/ - Update the skill's
SKILL.mdtable to reference the new rule - Semgrep rules go in
semgrep/ - Do not add runtime code here — this repo is agent-readable documentation and configuration only