How do I install the Security Documentation skill?

Run npx skillmds@latest add tomevault-io/security-documentation-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Documentation safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Documentation?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Documentation free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Documentation?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Documentation by tomevault-io

Name: Security Documentation
Author: tomevault-io

File contents

Security Documentation Standards

Purpose

Maintain comprehensive security documentation per Hack23 ISMS requirements.

Required Documents

Current State

✅ SECURITY_ARCHITECTURE.md - Implemented security controls
✅ THREAT_MODEL.md - STRIDE threat analysis
✅ ARCHITECTURE.md - System design with C4 models
✅ SECURITY.md - Security policy and vulnerability reporting

Future State

✅ FUTURE_SECURITY_ARCHITECTURE.md - Planned security improvements

Document Structure

SECURITY_ARCHITECTURE.md:

# Security Architecture

## Executive Summary
## Security Controls
### Network Security
### Application Security
### Access Control
### Data Protection
### Monitoring & Detection
## Compliance Mapping
### ISO 27001:2022
### NIST CSF 2.0
### CIS Controls v8.1
## References

THREAT_MODEL.md:

# Threat Model

## Asset Inventory
## STRIDE Analysis
### Spoofing Threats
### Tampering Threats
### Repudiation Threats
### Information Disclosure Threats
### Denial of Service Threats
### Elevation of Privilege Threats
## Risk Assessment
## Mitigation Controls
## Residual Risks

Quality Standards

Use C4 diagrams (Context, Container, Component)
Include Mermaid diagrams for complex workflows
Map to ISO 27001/NIST CSF/CIS Controls
Version control metadata (version, date, owner)
Classification marking (Public, Internal, Confidential)

References

ISMS-PUBLIC: https://github.com/Hack23/ISMS-PUBLIC
Secure Development Policy: https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: security-documentation-2description: ISMS security documentation standards for Hack23 projects Use when this capability is needed.---# Security Documentation Standards## PurposeMaintain comprehensive security documentation per Hack23 ISMS requirements.## Required Documents### Current State- ✅ **SECURITY_ARCHITECTURE.md** - Implemented security controls- ✅ **THREAT_MODEL.md** - STRIDE threat analysis- ✅ **ARCHITECTURE.md** - System design with C4 models- ✅ **SECURITY.md** - Security policy and vulnerability reporting### Future State- ✅ **FUTURE_SECURITY_ARCHITECTURE.md** - Planned security improvements## Document Structure**SECURITY_ARCHITECTURE.md:**```markdown# Security Architecture## Executive Summary## Security Controls### Network Security### Application Security### Access Control### Data Protection### Monitoring & Detection## Compliance Mapping### ISO 27001:2022### NIST CSF 2.0### CIS Controls v8.1## References```**THREAT_MODEL.md:**```markdown# Threat Model## Asset Inventory## STRIDE Analysis### Spoofing Threats### Tampering Threats### Repudiation Threats### Information Disclosure Threats### Denial of Service Threats### Elevation of Privilege Threats## Risk Assessment## Mitigation Controls## Residual Risks```## Quality Standards- Use C4 diagrams (Context, Container, Component)- Include Mermaid diagrams for complex workflows- Map to ISO 27001/NIST CSF/CIS Controls- Version control metadata (version, date, owner)- Classification marking (Public, Internal, Confidential)## References- **ISMS-PUBLIC**: https://github.com/Hack23/ISMS-PUBLIC- **Secure Development Policy**: https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md---> Converted and distributed by [TomeVault](https://tomevault.io/claim/hack23) — claim your Tome and manage your conversions.

Frequently asked questions

Security Documentation