security-reviewer-formats

The house style for security and Responsible AI review write-ups: what a report looks like, what a single finding looks like, and what each severity level means.

WHEN TO USE

SCOPE

USE FOR

Get a standard report template for a vulnerability review, a review plan, or a Responsible AI review.
Write up a single security or Responsible AI finding in the shared format subagents pass to each other.
Look up the standard severity levels shared across every security assessment this skill supports.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (3)

Security Reviewer Formats — Skill Entry

This SKILL.md is the entrypoint for the security reviewer format specifications skill.

The skill provides shared format templates and data contracts used by security, accessibility, and RAI review orchestrators and their subagents. Each reference file covers a focused area of the reporting pipeline.

Normative references

Report Formats — VULN_REPORT_V1, PLAN_REPORT_V1, and RAI_REPORT_V1 templates.
Finding Formats — Security and RAI finding, verification, and collection formats.
Completion Formats — Scan status, completion, RAI response, and terminal error formats.
Severity Definitions — Standard severity level definitions for all OWASP skill assessments.

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — format specification documents.
- report-formats.md — full report templates for audit, diff, and plan modes.
- finding-formats.md — serialization and collection formats for findings exchange between subagents.
- completion-formats.md — status updates, completion summaries, and the minimal profile stub.
- severity-definitions.md — severity level table shared across all assessments.

No requirements beyond installing this skill were found.

Listed as free: Connected services may require an account or charge fees.
Installation: One command — usually under 2 minutes.

Not standalone. This skill ships with microsoft/hve-core and only works together with that tool — install the tool first, then add this skill.

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add microsoft/hve-core --skill "security-reviewer-formats" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

What's inside

Files included with this skill.

View on GitHub

The repository is licensed under MIT — use, modification, and redistribution are allowed under that license’s terms.

View the repository’s license file on GitHub →

Security Reviewer Formats — Skill Entry

Normative references

Skill layout

No requirements beyond installing this skill were found.

What's inside

More skills

MCP keyword matches