ingest-cwe-taxonomies

by microsoft

Ingest the official MITRE CWE database and generate per-domain security audit taxonomies for PromptKit. Use this skill when the user wants to update CWE…

npx skills add https://github.com/microsoft/promptkit --skill ingest-cwe-taxonomies
Download ZIPGitHub
83

You must read and execute the prompt file at .github/prompts/ingest-cwe-taxonomies.prompt.md. Treat it as the complete, self-contained instruction set for the CWE ingestion pipeline.

Inputs

  • CWE source: A local path to a CWE XML file, or latest to download the current release from https://cwe.mitre.org/data/xml/cwec_latest.xml.zip.
  • Any overrides to the domain registry or mapping rules the user specifies.

Output

  • Per-domain taxonomy files at taxonomies/cwe-<domain>.md (13 domains)
  • Normalized CWE data at data/cwe/<version>/
  • Updated manifest.yaml with new taxonomy entries
  • Reusable ingestion script at scripts/ingest-cwe.py
  • Diff report if a previous CWE version exists

Workflow

  1. Read .github/prompts/ingest-cwe-taxonomies.prompt.md before doing anything else.
  2. Ask the user for the CWE source (path or latest).
  3. Follow all six phases defined in the prompt file: Acquisition, Normalization, Domain Mapping, Taxonomy Generation, Integration, and Verification.
  4. Do NOT skip the sanity checks in Phase 6.

More skills from microsoft

oss-growth
microsoft
OSS growth hacker persona
official
accessibility-aria-expert
microsoft
Detects and fixes accessibility issues in React/Fluent UI webviews. Use when reviewing code for screen reader compatibility, fixing ARIA labels, ensuring…
official
generate-canvas-app
microsoft
[DEPRECATED — use canvas-app instead] Generate a complete Power Apps canvas app.
official
django
microsoft
Best practices for Django web development including models, views, templates, and testing.
official
github-issue-creator
microsoft
Convert raw notes, error logs, voice dictation, or screenshots into crisp GitHub-flavored markdown issue reports. Use when the user pastes bug info, error…
official
python-package-management
microsoft
Uses uv for dependency management and poethepoet for task automation.
official
runtime-validation
microsoft
Runtime validation for migrated applications — covers testing strategy (planning phase) and test execution (validation phase): startup verification,…
official
azure-postgres-ts
microsoft
Connect to Azure Database for PostgreSQL Flexible Server using the pg (node-postgres) package with support for password and Microsoft Entra ID (passwordless) authentication.
official