security SKILL.md skillA
security from lamngockhuong/aiteamkit is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add lamngockhuong/aiteamkit/security@git:20261106.96eea03Pins git:20261106.96eea03 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- lamngockhuong/aiteamkit
- Path
plugins/atk/skills/security/SKILL.md- Versions recorded
- 7
- Latest version
- git:20261106.96eea03, committed Nov 6, 2026
- First version recorded
- Oct 1, 2026
- Size
- 13,378 bytes
- Repository stars
- 12
- License
- MIT
Review the security of a change, a release, or a feature the way a team has to answer for it: the assets and trust boundaries in scope, the project's own scanners run, threats walked per boundary, every finding verified against the code with the path from entry point to impact, a checklist from the client or the company answered item by item with evidence, and the residual risk left for a named person to accept. Also keeps the threat model of a feature current. Use before a release that…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Review (`atk:security`) Produces the security record a Tech Lead can sign and a client can read: what was in scope, what was checked and how, what was found with the evidence behind it, and what is left open with the name of whoever accepted it. A finding without a path from an entry point to an impact is a worry, not a finding, and the record keeps the two apart. ## Scope Handles: resolving the scope into assets, actors, entry points, and trust boundaries; running the project's own dependency audit and the secret scan over tracked files; walking the threats per boundary against `references/threat-checklist.md`; verifying each candidate against the code; answering a supplied security checklist item by item; and writing or updating the threat model of a feature. Does NOT handle: fixing a finding, which is `atk:fix` for a defect and `atk:implement` for a missing control; rotating a credential or rewriting git history, which the owner of the credential and the repository does; reviewing a pull request for everything else (`atk:review`); writing test cases for a control (`atk:qa`); responding to a live breach (`atk:incident`); the license obligations of …
Read the whole file at its exact version.
How to install
mdr add lamngockhuong/aiteamkit/security@sha256:e6288b5270787fe3The line at the top of this page pins the label git:20261106.96eea03, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_r3yk4mpetub5hkho)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 7 versions of this file, between Oct 1, 2026 and Nov 6, 2026, about one every 6 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261106.96eea03 latest | 2026-11-06 | 96eea03 | 13,378 B | A | view · diff |
| git:20261016.1a28b84 | 2026-10-16 | 1a28b84 | 13,606 B | A | view · diff |
| git:20261016.18521b0 | 2026-10-16 | 18521b0 | 13,538 B | A | view · diff |
| git:20261014.03c655e | 2026-10-14 | 03c655e | 12,212 B | A | view · diff |
| git:20261010.92e1a54 | 2026-10-10 | 92e1a54 | 12,002 B | A | view · diff |
| git:20261010.48f2f0b | 2026-10-10 | 48f2f0b | 11,899 B | A | view · diff |
| git:20261001.ed02384 | 2026-10-01 | ed02384 | 11,738 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (13378 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
lamngockhuong/aiteamkit · 12 stars · license MIT · pushed 2026-11-06 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_r3yk4mpetub5hkho GET https://markdownregistry.com/api/v1/resolve?ref=lamngockhuong/aiteamkit/security GET https://markdownregistry.com/api/v1/blob/e6288b5270787fe395e7d7df1d7bbcfeedb74a92b46caaffbea6f23e1b2f4c8f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from lamngockhuong/aiteamkit
Every file in lamngockhuong/aiteamkit