secure-by-design

Secure by Design principles knowledge base for assessing adherence to security-first design, development, and deployment practices across the software…

npx skills add https://github.com/microsoft/hve-core --skill secure-by-design

Download ZIP GitHub

Secure by Design — Skill Entry

This SKILL.md is the entrypoint for the Secure by Design skill.

The skill synthesizes the UK Government Secure by Design Principles (10 principles) and the Australian ASD/ACSC Secure by Design Foundations (6 foundations) into structured, machine-readable references that an agent can query to identify, assess, and improve adherence to secure-by-design practices across the software lifecycle.

Normative references (Secure by Design)

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — the Secure by Design normative documents.
- 00-principle-index.md — index of all principle identifiers, categories, source mappings, and cross-references.
- 01 through 11 — one document per synthesized principle area merging UK and AU guidance.

Third-Party Attribution

UK Government Secure by Design Principles

Copyright: Crown Copyright, UK Government Security Group
License: Open Government Licence v3.0 (OGL-UK-3.0)
Source: https://www.security.gov.uk/policy-and-guidance/secure-by-design/principles/
Modifications: Synthesized into structured principle-checklist format with cross-references; merged with Australian guidance into unified principle areas
Trademark: Use of UK Government content does not imply endorsement

Australian ASD/ACSC Secure by Design Foundations

Copyright: © Commonwealth of Australia, Australian Signals Directorate
License: Creative Commons Attribution 4.0 (CC-BY-4.0)
Source: https://www.cyber.gov.au/business-government/secure-design/secure-by-design/secure-by-design-foundations
Modifications: Synthesized into structured principle-checklist format with cross-references; merged with UK guidance into unified principle areas
Trademark: Use of ASD/ACSC content does not imply endorsement

More skills from microsoft

OSS growth hacker persona

agent-framework-azure-ai-py

Build Azure AI Foundry agents using the Microsoft Agent Framework Python SDK (agent-framework-azure-ai). Use when creating persistent agents with AzureAIAgentsProvider, using hosted tools (code interpreter, file search, web search), integrating MCP servers, managing conversation threads, or implementing streaming responses. Covers function tools, structured outputs, and multi-tool agents.

airunway-aks-setup

Set up AI Runway on AKS — from bare cluster to running model. Covers cluster verification, controller install, GPU assessment, provider setup, and first deployment. WHEN: "setup AI Runway", "onboard AKS cluster", "install AI Runway", "airunway setup", "deploy model to AKS", "GPU inference on AKS", "KAITO setup on AKS", "run LLM on AKS", "vLLM on AKS", "set up model serving on AKS", "AI Runway controller".

appinsights-instrumentation

Guidance for instrumenting webapps with Azure Application Insights. Provides telemetry patterns, SDK setup, and configuration references. WHEN: how to instrument app, App Insights SDK, telemetry patterns, what is App Insights, Application Insights guidance, instrumentation examples, APM best practices.

applicationinsights-web-ts

Instrument browser/web apps with the Application Insights JavaScript SDK (@microsoft/applicationinsights-web). Use for Real User Monitoring (RUM) — page views, clicks, AJAX/fetch dependencies, exceptions, custom events, and browser-side GenAI agent traces correlated to backend OpenTelemetry traces. Covers SDK Loader Script and npm setup, framework extensions (React, React Native, Angular), Click Analytics, telemetry initializers, and OTel GenAI semantic conventions for agent/tool/model spans emitted from the browser.

azure-ai-anomalydetector-java

Build anomaly detection applications with Azure AI Anomaly Detector SDK for Java. Use when implementing univariate/multivariate anomaly detection, time-series analysis, or AI-powered monitoring.

azure-ai-language-conversations-py

Implement Conversational Language Understanding (CLU) using the azure-ai-language-conversations Python SDK. Use when working with ConversationAnalysisClient to analyze conversation intent and entities, building NLP features, or integrating language understanding into applications.

Azure Machine Learning SDK v2 for Python. Use for ML workspaces, jobs, models, datasets, compute, and pipelines. Triggers: "azure-ai-ml", "MLClient", "workspace", "model registry", "training jobs", "datasets".