copilot-security-instructions

Name: copilot-security-instructions
Author: robotti-io

byrobotti-io· 1 MCP server

Stars

Forks

How to install copilot-security-instructions?

robotti-io/copilot-security-instructions

$git clone https://github.com/robotti-io/copilot-security-instructions

Installs into the current project.

›Prefer a prompt? Paste this to your agent

Install & use

Install copilot-security-instructions by running `git clone https://github.com/robotti-io/copilot-security-instructions`, then use it for the current task and follow its documentation at https://github.com/robotti-io/copilot-security-instructions.

Files · 1

View on GitHub

README.md

1	# 🛡️ Copilot Security Instructions
2
3	[![Verified on MseeP](https://mseep.ai/badge.svg)](https://mseep.ai/app/1a935343-666d-457a-b210-2e0d27e9ef81)
4
5	A comprehensive toolkit to guide GitHub Copilot toward secure coding practices. This project includes customizable instructions and security-focused prompts to help development teams identify and mitigate security risks effectively.
6
7	Designed for security-conscious teams, this configuration ensures Copilot suggests safer code patterns, avoids common vulnerabilities, and reinforces best practices — all without disrupting your workflow.
8
9	---
10
11	## 🔐 What's Inside
12
13	This project offers:
14
15	- Secure-by-default guidance for all languages (e.g., input validation, secret handling, safe logging).
16	- Language-specific secure patterns:
17	- ☕ Java
18	- 🟩 Node.js
19	- 🟦 C#
20	- 🐍 Python
21	- "Do Not Suggest" lists to block risky Copilot completions (e.g., `eval`, inline SQL, insecure deserialization).
22	- AI hallucination protections to prevent package spoofing, non-existent APIs, and misinformation risks.
23	- Mentorship-style tips to help newer engineers build secure coding habits.
24	- Custom agents & Agent Skills under `agents/` and `skills/` for repeatable AppSec workflows inside Copilot.
25	- An installable GitHub Copilot CLI plugin under `plugins/copilot-security` for reusable AppSec agents and skills across projects.
26	- An MCP server for seamless integration of these prompts into other projects.
27
28	---
29
30	## 🗂️ Prompt Catalogue
31
32	Explore the available prompts and their intended use cases:
33
34	These prompt files live under `prompts/` in this repo and are intended to be copied into a consuming repository’s `.github/prompts/`.
35
36	Recommended workflow: start with the `application-security-orchestrator` agent (see `agents/application-security-orchestrator.agent.md`).
37	It standardizes intake, then hands off to specialist agents (Analyst/Architect/Engineer) depending on whether you want findings, a threat model, or implemented fixes.
38
39	\| Prompt \| Description \| Intended Use \|
40	\| --- \| --- \| --- \|
41	\| [access-control-review.prompt.md](prompts/access-control-review.prompt.md) \| Review and report on access control / authorization architecture for project. \| Perform analysis of the current architecture for access control and authorization within the project. \|
42	\| [assess-logging.prompt.md](prompts/assess-logging.prompt.md) \| Identify unsafe logging and exposure of sensitive data. \| Audit log output for leaks and recommend safer patterns. \|
43	\| [business-logic-review.prompt.md](prompts/business-logic-review.prompt.md) \| Analyze overall business logic flow and decision making. \| Map application behavior and critique critical logic paths. \|
44	\| [check-access-controls.prompt.md](prompts/check-access-controls.prompt.md) \| Audit authorization and access control weaknesses. \| Ensure RBAC/ABAC enforcement and consistent permission checks. \|
45	\| [check-for-secrets.prompt.md](prompts/check-for-secrets.prompt.md) \| Detect hardcoded secrets and credentials. \| Locate embedded keys or tokens and suggest secure storage. \|
46	\| [check-for-unvalidated-genai-acceptances.prompt.md](prompts/check-for-unvalidated-genai-acceptances.prompt.md) \| Find unvalidated AI-generated code or hallucinated assets. \| Verify that AI suggestions are real, tested, and documented. \|
47	\| [add-content-security-policy.prompt.md](prompts/add-content-security-policy.prompt.md) \| Design, implement, and roll out a new Content Security Policy (CSP) safely. \| Add CSP to a web app with a deployable policy string, rollout plan, and verification steps. \|
48	\| [csp-review.prompt.md](prompts/csp-review.prompt.md) \| Review a web application’s Content-Security-Policy (CSP) for XSS resistance, safe third-party usage, and deployability. \| Evaluate an existing CSP policy and recommend hardening + rollout steps. \|
49	\| [dependency-cve-triage.prompt.md](prompts/dependency-cve-triage.prompt.md) \| Triage a known CVE against a project's dependency: explain the exploi

6 picks

Type

Install copilot-security-instructions by running `git clone https://github.com/robotti-io/copilot-security-instructions`, then use it for the current task and follow its documentation at https://github.com/robotti-io/copilot-security-instructions.

copilot-security-instructions

How to install copilot-security-instructions?

Related

copilot-security-instructions

How to install copilot-security-instructions?

Related