Security architecture skill

[eoftedal]

Skill to describe the application and it's security properties (not vulnerability/weakness focused - purely a descriptive skill)

[Mayur021]

Thanks for pulling AISVS into the skill data, it's a useful grounding source. One correctness issue worth fixing before merge: the bundled AISVS chapters under plugins/code-security-skills/data/aisvs/ are from a pre-v1.0 draft, and the mismatch runs across the whole set, not just one chapter. Released AISVS v1.0 (June 2026) renumbered and restructured the chapters, so by-number citations from these skills will point at the wrong control.

Checked against released v1.0 (OWASP/AISVS, 1.0/en/):

• Chapter count: v1.0 has 12 chapters, C01 through C12. The bundle carries 13, C01 through C13; C13 (Kill-Switch & Override) does not exist as a chapter in v1.0.
• The chapter numbers map to different topics. Bundle C10 is "Model Alignment & Safety"; v1.0 C10 is "Model Context Protocol (MCP) Security." Bundle C11 is "Anonymization & Data Minimization"; v1.0 C11 is "Adversarial Robustness." A finding tagged C10 or C11 by these skills would cite the wrong subject.
• Sub-requirement counts differ in every chapter (for example C02 has 2 in v1.0 versus 8 here; C09 has 6 versus 9; C10 has 4 versus 9).
• C09 specifically, the agentic chapter the agent-security skills lean on: v1.0 C9.2 has ten requirements, 9.2.1 through 9.2.10, including 9.2.3 trusted reversibility classification, 9.2.4 runtime enforcement of those classes, and 9.2.10 the worst-case rule across multi-step or multi-agent chains. The bundled C9.2 stops at 9.2.3, and its 9.2.3 is a different control (rollback/compensating actions), so the reversibility and chain-composition controls are absent.

Since the skill's value is OWASP-grounded traceability, recommend re-syncing the entire data/aisvs/ set from the 1.0/en source before merge, so the chapter numbers and control IDs match the released standard.