feat(agents): add Security Champion agent with SDL and OWASP guidance by obrocki · Pull Request #408 · microsoft/hve-core

obrocki · 2026-02-04T10:06:10Z

Pull Request

Description

Adds a Security Champion agent, skill, and supporting instructions to provide comprehensive security guidance by integrating Microsoft's Security Development Lifecycle (SDL) practices alongside existing OWASP frameworks.

Incorporates all 10 Microsoft SDL practices for secure software development
Organizes security inspection areas by development lifecycle stage (Design, Code, Build/Deploy, Runtime)
Adds guidance for threat modeling, Zero Trust principles, and supply chain security
Expands responsibilities to include security design reviews and Secure by Design promotion
Maintains existing OWASP Top 10 and OWASP Top 10 for LLM Applications (2025) references
Restructures the security champion agent to eliminate context window overhead by moving OWASP content from always-loaded instruction files (applyTo: '**/*') into an on-demand skill with dedicated reference documents

Related Issue(s)

Closes #416

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)
Copilot skill (.github/skills/*/SKILL.md)

Note for AI Artifact Contributors:

Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.

Skills: Must include both bash and PowerShell scripts. See Skills.

Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.

See Agents Not Accepted and Model Version Requirements.

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Sample Prompts (for AI Artifact Contributions)

Testing

Tested prompts against security review scenarios
Verified agent loads skill content on demand rather than via always-loaded instructions

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (if applicable)

AI Artifact Contributions

Used /prompt-analyze to review contribution
Addressed all feedback from prompt-builder review
Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Skill structure validation: npm run validate:skills
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps
Plugin freshness: npm run plugin:generate

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

Reviewed contribution with prompt-builder agent.

codecov-commenter · 2026-02-04T10:08:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.37%. Comparing base (8fd1243) to head (368940e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #408   +/-   ##
=======================================
  Coverage   85.37%   85.37%           
=======================================
  Files          27       27           
  Lines        5073     5073           
=======================================
  Hits         4331     4331           
  Misses        742      742

Flag	Coverage Δ
pester	`85.37% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR adds a Security Champion agent and comprehensive OWASP security instruction files to integrate Microsoft's Security Development Lifecycle (SDL) practices alongside existing OWASP frameworks. The PR introduces security guidance across the development lifecycle, from design through runtime, with detailed coding standards for both traditional web applications and LLM-specific security concerns.

Changes:

Adds Security Champion conversational agent for security-focused code review and advisory
Introduces comprehensive OWASP Top 10 secure coding instructions for web applications
Adds OWASP Top 10 for LLM Applications (2025) secure coding instructions for AI/ML security

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 14 comments.

File	Description
`.github/agents/security-champion.agent.md`	New conversational agent that serves as a security advisor, integrating Microsoft SDL practices with OWASP frameworks to guide security reviews across all development stages
`.github/instructions/owasp-for-web-applications.instructions.md`	New instruction file providing comprehensive secure coding guidelines based on OWASP Top 10, covering vulnerabilities from access control to SSRF
`.github/instructions/owasp-for-llms.instructions.md`	New instruction file providing LLM-specific security guidelines based on OWASP Top 10 for LLM Applications (2025), covering prompt injection, data leakage, and other AI-specific risks

.github/instructions/owasp-for-web-applications.instructions.md

.github/agents/security-planning/security-champion.agent.md

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-llms.instructions.md

.github/skills/security-planning/owasp-security/references/owasp-web-applications.md

.github/instructions/owasp-for-web-applications.instructions.md

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

.github/instructions/owasp-for-llms.instructions.md

.github/agents/security-planning/security-champion.agent.md

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/agents/security-champion.agent.md

WilliamBerryiii · 2026-02-04T22:00:59Z

Hi! A small request: could you update the PR title to include the conventional commit format with scope? This ensures release-please picks it up correctly for the changelog.

Suggested: `feat(agents): add security champion agent with Microsoft SDL practices

Thanks!

katriendg

Thanks for your contribution. This is valuable, there are a few optimizations I feel are relevant before we merge.

Please re-run the /prompt-analyse or prompt-builder agent again and ensure you add your new files to the context, and ask it to review your three files for recommendations. There are several open recommendations you can still apply before we merge.
Evaluate the usage of the .instructions.md files and applyTo. Is it possible to merge into the custom agent instead? Especially for the LLM application instructions we do not want to enforce this upon every single edit of applicable files. Again here the Task-Researcher and/or Prompt Builder agents may help you refactor some of this in an efficient way.
## Required Phases given this agent has specific phases (in your case Stages), you should be able to easily reformat the agent to follow the phases approach. Also prompt-builder may do this for you.

Hope these make sense!

.github/agents/security-champion.agent.md

.github/agents/security-planning/security-champion.agent.md

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/skills/security-planning/owasp-security/references/owasp-llm-applications.md

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

.github/instructions/owasp-for-llms.instructions.md

.github/agents/security-planning/security-champion.agent.md

.github/instructions/owasp-for-llms.instructions.md

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

katriendg · 2026-02-06T08:51:37Z

Thanks for your changes, I think this is looking good for an initial inclusion into experimental pre-release so we can have some active testing, see how it behaves when used together with some of the other instructions and agents.
Please review any open comments and close them, either adopt the recommendation or leave a note and close the comment. Some of the Copilot comments are valid, some you may just want to discard, or simply outdated.
Once all comments are closed I will do a final review and expect Approval soon from my side.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

.github/CUSTOM-AGENTS.md

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

.github/agents/security-planning/security-champion.agent.md

.github/skills/security-planning/owasp-security/references/owasp-web-applications.md

.github/skills/security-planning/owasp-security/references/owasp-llm-applications.md

.github/instructions/security/owasp-for-web-applications.instructions.md

.github/instructions/security/owasp-for-llms.instructions.md

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

.github/agents/security-champion.agent.md

katriendg · 2026-02-16T15:01:18Z

@obrocki thanks for the refactoring.
I believe we still need to address a few things within the skills, as the content in skills is still quite monolithic and may benefit from adding structured output formats, detailed OWASP category validations, more actionable detection guidance, etc.
Knowing you are away I will ping you offline to further discuss, and for now put this PR in draft mode so folks know the status is still in development.

Add security-champion agent with Microsoft SDL practices and OWASP frameworks for web applications and LLM systems. Includes skill package with reference documentation for OWASP Top 10 guidelines. - Security champion agent (experimental) in security-planning collection - OWASP security skill with web and LLM reference material - Collection manifests updated for security-planning and hve-core-all

WilliamBerryiii · 2026-03-07T03:50:45Z

Hey @obrocki — thanks for the Security Champion agent contribution! 🛡️ We've updated the PR title to follow our conventional commits format and restructured the description to align with the current PR template. No action needed on your end.

WilliamBerryiii · 2026-03-07T04:48:15Z

We've updated the PR description to align with the current pull request template. All original content has been preserved and relocated into the appropriate template sections. No action needed on your end — though you're welcome to review the updated description and fill in any remaining sections (testing details, checklist confirmations, etc.) at your convenience.

katriendg · 2026-03-09T06:53:50Z

@obrocki closing this one after our offline discussions and the plan for reworking this into the new agent and skills. Looking forward to the reworked contributions.

Copilot AI review requested due to automatic review settings February 4, 2026 10:06

Copilot started reviewing on behalf of obrocki February 4, 2026 10:06 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 4, 2026 14:03

Copilot started reviewing on behalf of obrocki February 4, 2026 14:04 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 4, 2026 14:54

Copilot started reviewing on behalf of obrocki February 4, 2026 14:54 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

.github/instructions/owasp-for-llms.instructions.md Outdated Show resolved Hide resolved

.github/agents/security-planning/security-champion.agent.md Show resolved Hide resolved

obrocki marked this pull request as ready for review February 4, 2026 16:24

obrocki requested a review from a team as a code owner February 4, 2026 16:24

Copilot AI review requested due to automatic review settings February 4, 2026 16:54

Copilot started reviewing on behalf of obrocki February 4, 2026 16:54 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

obrocki mentioned this pull request Feb 4, 2026

feat(agents): Add Security Champion agent with SDL and OWASP guidance #416

Open

WilliamBerryiii reviewed Feb 4, 2026

View reviewed changes

.github/agents/security-champion.agent.md Outdated Show resolved Hide resolved

WilliamBerryiii reviewed Feb 4, 2026

View reviewed changes

.github/agents/security-champion.agent.md Outdated Show resolved Hide resolved

WilliamBerryiii added this to the v2.2.0 milestone Feb 5, 2026

katriendg requested changes Feb 5, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 5, 2026 14:52

Copilot started reviewing on behalf of obrocki February 5, 2026 14:52 View session

Copilot AI reviewed Feb 5, 2026

View reviewed changes

.github/instructions/owasp-for-llms.instructions.md Outdated Show resolved Hide resolved

.github/agents/security-planning/security-champion.agent.md Show resolved Hide resolved

.github/instructions/owasp-for-llms.instructions.md Outdated Show resolved Hide resolved

Copilot AI review requested due to automatic review settings February 5, 2026 19:48

Copilot started reviewing on behalf of obrocki February 5, 2026 19:49 View session

obrocki requested a review from katriendg February 5, 2026 19:49

Copilot AI reviewed Feb 5, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 6, 2026 13:28

Copilot AI reviewed Feb 13, 2026

View reviewed changes

.github/CUSTOM-AGENTS.md Show resolved Hide resolved

Copilot AI review requested due to automatic review settings February 13, 2026 16:56

obrocki force-pushed the feat/security-champion-agent branch from 673ade6 to c8e2456 Compare February 13, 2026 16:56

Copilot started reviewing on behalf of obrocki February 13, 2026 16:57 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

WilliamBerryiii modified the milestones: v2.3.0, v2.4.0 Feb 13, 2026

Copilot AI review requested due to automatic review settings February 15, 2026 12:50

Copilot started reviewing on behalf of obrocki February 15, 2026 12:50 View session

Copilot AI reviewed Feb 15, 2026

View reviewed changes

.github/agents/security-champion.agent.md Outdated Show resolved Hide resolved

katriendg marked this pull request as draft February 16, 2026 15:01

This was referenced Feb 16, 2026

feat(instructions): Secure by design #523

Open

feat(skills): Mandate unit testing, extend CI coverage, and document language support process #634

Closed

obrocki force-pushed the feat/security-champion-agent branch 2 times, most recently from 5af9817 to 73c7476 Compare February 24, 2026 14:37

obrocki force-pushed the feat/security-champion-agent branch from 73c7476 to 1fcd5a7 Compare February 24, 2026 14:44

Merge branch 'main' into feat/security-champion-agent

368940e

WilliamBerryiii modified the milestones: v3.0.0, v3.1.0 Feb 26, 2026

katriendg mentioned this pull request Feb 27, 2026

feat(agents): add security-reviewer agent with OWASP-aligned skill delegation #794

Closed

7 tasks

WilliamBerryiii modified the milestones: v3.1.0, v3.2.0 Mar 1, 2026

katriendg closed this Mar 9, 2026

Conversation

obrocki commented Feb 4, 2026 • edited by WilliamBerryiii Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Description

Related Issue(s)

Type of Change

Sample Prompts (for AI Artifact Contributions)

Testing

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

codecov-commenter commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

WilliamBerryiii commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

katriendg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

obrocki commented Feb 4, 2026 •

edited by WilliamBerryiii

Loading

codecov-commenter commented Feb 4, 2026 •

edited

Loading

WilliamBerryiii commented Feb 4, 2026 •

edited

Loading