The Security plugin follows the NIST Cybersecurity Framework (CSF) 2.0 in six phases: govern, identify, protect, detect, respond and recover. It starts with policy and risk appetite and ends with recovery and continuity plans. Each phase writes a numbered file to .singularskills/security/<topic>/. Five utility skills cover checklists, threat intel, compliance mapping, training and pentest plans.

The Six Phases

Phase	Command Prefix	Purpose
Govern	`/security-security-policy`, etc.	Establish security governance, risk appetite, roles, and culture
Identify	`/security-asset-inventory`, etc.	Discover assets, model threats, assess vulnerabilities and risks
Protect	`/security-secure-coding`, etc.	Implement safeguards — coding, secrets, access, encryption
Detect	`/security-monitoring-strategy`, etc.	Define monitoring, logging, anomaly detection, and testing
Respond	`/security-incident-response`, etc.	Plan incident response, forensics, communication, and containment
Recover	`/security-recovery-plan`, etc.	Recovery planning, backup validation, business continuity

The Security Lifecycle

The methodology follows the NIST CSF 2.0 lifecycle:

Govern (Phase 0): Establish the security governance foundation — define policies, risk appetite, roles and responsibilities, supply chain security requirements, and security culture initiatives.

Identify (Phase 1): Understand the environment — inventory assets, model threats, assess vulnerabilities, evaluate risks, map attack surfaces, classify data, and identify compliance gaps.

Protect (Phase 2): Implement safeguards — secure coding standards, dependency scanning, secrets management, access controls, encryption strategies, API security, container security, and infrastructure-as-code security.

Detect (Phase 3): Define detection capabilities — monitoring strategies, logging architecture, anomaly detection rules, security testing procedures, and SIEM configuration.

Respond (Phase 4): Prepare for incidents — incident response plans, forensic readiness, communication templates, containment strategies, and lessons-learned processes.

Recover (Phase 5): Plan recovery — recovery procedures, backup validation, business continuity planning, and resilience improvement cycles.

Artifact Flow

Each phase reads from previous phases and writes to .singularskills/security/<topic>/:

.singularskills/security/api-platform/
  00-govern.md       ← Govern phase output
  01-identify.md     ← Identify phase output
  02-protect.md      ← Protect phase output
  03-detect.md       ← Detect phase output
  04-respond.md      ← Respond phase output
  05-recover.md      ← Recover phase output

Utility Skills

Five utility skills work across all phases without prerequisites:

/security-security-checklist — Generate security checklists for projects and releases
/security-threat-intel — Research threat intelligence for specific technologies or industries
/security-compliance-map — Map security controls to compliance frameworks
/security-security-training — Create security awareness training materials
/security-pentest-plan — Plan penetration testing engagements

Quality Gates

The skills enforce phase ordering:

Gates: each later phase's skill runs its scripts/gate.sh first and stops if a required earlier artifact (such as the Govern artifact) is missing
You can bypass with --skip-checks when needed (logged as a skipped event in .singularskills/log.jsonl)
Utility skills have no prerequisites

Important Disclaimer

All content generated by the Security plugin is AI-generated and intended for planning and documentation assistance purposes only. It does not replace professional security assessments, penetration testing, or compliance audits. Always have qualified security professionals review any security plans before implementation.

Skills in this domain

39 skills in this domain

Security Domain Overview