copilot-security-instructions
starsforks
How to install copilot-security-instructions?
robotti-io/copilot-security-instructions
$git clone https://github.com/Robotti-io/copilot-security-instructionsA comprehensive toolkit to guide GitHub Copilot toward secure coding practices. This project includes customizable instructions and security-focused prompts to help development teams identify and mitigate security risks effectively.
README.md
| 1 | # 🛡️ Copilot Security Instructions |
| 2 | |
| 3 | [](https://mseep.ai/app/1a935343-666d-457a-b210-2e0d27e9ef81) |
| 4 | |
| 5 | A comprehensive toolkit to guide **GitHub Copilot** toward **secure coding practices**. This project includes customizable instructions and security-focused prompts to help development teams identify and mitigate security risks effectively. |
| 6 | |
| 7 | Designed for security-conscious teams, this configuration ensures Copilot suggests safer code patterns, avoids common vulnerabilities, and reinforces best practices — all without disrupting your workflow. |
| 8 | |
| 9 | --- |
| 10 | |
| 11 | ## 🔐 What's Inside |
| 12 | |
| 13 | This project offers: |
| 14 | |
| 15 | - **Secure-by-default guidance** for all languages (e.g., input validation, secret handling, safe logging). |
| 16 | - **Language-specific secure patterns**: |
| 17 | - ☕ Java |
| 18 | - 🟩 Node.js |
| 19 | - 🟦 C# |
| 20 | - 🐍 Python |
| 21 | - **"Do Not Suggest" lists** to block risky Copilot completions (e.g., `eval`, inline SQL, insecure deserialization). |
| 22 | - **AI hallucination protections** to prevent package spoofing, non-existent APIs, and misinformation risks. |
| 23 | - **Mentorship-style tips** to help newer engineers build secure coding habits. |
| 24 | - **Custom agents & Agent Skills** under `agents/` and `skills/` for repeatable AppSec workflows inside Copilot. |
| 25 | - **An installable GitHub Copilot CLI plugin** under `plugins/copilot-security` for reusable AppSec agents and skills across projects. |
| 26 | - **An MCP server** for seamless integration of these prompts into other projects. |
| 27 | |
| 28 | --- |
| 29 | |
| 30 | ## 🗂️ Prompt Catalogue |
| 31 | |
| 32 | Explore the available prompts and their intended use cases: |
| 33 | |
| 34 | These prompt files live under `prompts/` in this repo and are intended to be copied into a consuming repository’s `.github/prompts/`. |
| 35 | |
| 36 | **Recommended workflow:** start with the `application-security-orchestrator` agent (see `agents/application-security-orchestrator.agent.md`). |
| 37 | It standardizes intake, then hands off to specialist agents (Analyst/Architect/Engineer) depending on whether you want findings, a threat model, or implemented fixes. |
| 38 | |
| 39 | | Prompt | Description | Intended Use | |
| 40 | | --- | --- | --- | |
| 41 | | [access-control-review.prompt.md](prompts/access-control-review.prompt.md) | Review and report on access control / authorization architecture for project. | Perform analysis of the current architecture for access control and authorization within the project. | |
| 42 | | [assess-logging.prompt.md](prompts/assess-logging.prompt.md) | Identify unsafe logging and exposure of sensitive data. | Audit log output for leaks and recommend safer patterns. | |
| 43 | | [business-logic-review.prompt.md](prompts/business-logic-review.prompt.md) | Analyze overall business logic flow and decision making. | Map application behavior and critique critical logic paths. | |
| 44 | | [check-access-controls.prompt.md](prompts/check-access-controls.prompt.md) | Audit authorization and access control weaknesses. | Ensure RBAC/ABAC enforcement and consistent permission checks. | |
| 45 | | [check-for-secrets.prompt.md](prompts/check-for-secrets.prompt.md) | Detect hardcoded secrets and credentials. | Locate embedded keys or tokens and suggest secure storage. | |
| 46 | | [check-for-unvalidated-genai-acceptances.prompt.md](prompts/check-for-unvalidated-genai-acceptances.prompt.md) | Find unvalidated AI-generated code or hallucinated assets. | Verify that AI suggestions are real, tested, and documented. | |
| 47 | | [add-content-security-policy.prompt.md](prompts/add-content-security-policy.prompt.md) | Design, implement, and roll out a new Content Security Policy (CSP) safely. | Add CSP to a web app with a deployable policy string, rollout plan, and verification steps. | |
| 48 | | [csp-review.prompt.md](prompts/csp-review.prompt.md) | Review a web application’s Content-Security-Policy (CSP) for XSS resistance, safe third-party usage, and deployability. | Evaluate an existing CSP policy and recommend hardening + rollout steps. | |
| 49 | | [dependency-cve-triage.prompt.md](prompts/dependency-cve-triage.prompt.md) | Triage a known CVE against a project's dependency: explain the exploi |
People who liked this also viewed
6 picksType
- Resk-LLM Resk is a robust Python library designed to enhance security and manage context when interacting with LLMs. It provides a protective layer for API calls, safeguarding against common vulnerabilities and ensuring optimal performance. And safe layer again Prompt Injection. PromptsJun 2026
- agentic-ai-prompt-researchResearch into how agentic AI coding assistants work. Reconstructed prompt patterns, agent coordination, and security classificationPromptsMar 2026
- promptmapa security scanner for custom LLM applicationsPromptsDec 2025
- finite-monkey-engineAI engine for smart contract auditPromptsJan 2026
- prompt-hacker-collectionsprompt attack-defense, prompt Injection, reverse engineering notes and examples | 提示词对抗、破解例子与笔记 PromptsFeb 2025
- acipThe Advanced Cognitive Inoculation PromptPromptsMar 2026
