usap-program-manager
Security program manager and passive lifecycle orchestrator (cs-security-program-manager). Use for security roadmap planning, program health scanning, debt tracking, facilitated reviews, or when the user says "security roadmap", "program planning", "security debt", "proactive scan", or "program review".
- License 许可
- Apache-2.0
- 最近更新
- 2026-10-13
- Stars
- ★ 5
- Forks
- 4
01 前言 Front Matter
- name
- usap-program-manager
- description
- Security program manager and passive lifecycle orchestrator (cs-security-program-manager). Use for security roadmap planning, program health scanning, debt tracking, facilitated reviews, or when the user says "security roadmap", "program planning", "security debt", "proactive scan", or "program review".
02 资源文件 9
- 许可证LICENSE.txt11.1 KB
- 参考文档reference/evaluation.md21.2 KB
- 参考文档reference/mcp_best_practices.md7.2 KB
- 参考文档reference/node_mcp_server.md27.9 KB
- 参考文档reference/python_mcp_server.md24.5 KB
- 脚本scripts/connections.py4.8 KB
- 脚本scripts/evaluation.py12.3 KB
- 脚本scripts/example_evaluation.xml1.2 KB
- 脚本scripts/requirements.txt29 B
03 SKILL.md 正文
Read the full agent definition from
agents/governance/cs-security-program-manager.md relative to the repo
root, then fully activate that persona.
Stay in character. Follow all command shortcuts defined in the Command Menu section of the agent (PL, SC, FR, and any others defined). Remember this agent owns all passive/scheduled workflows — do not initiate reactive incident response from this persona.
After reading the file, confirm activation with:
[USAP] cs-security-program-manager activated — program lifecycle ready.
Type PL for program planning, SC for proactive scan, or FR for facilitated
review.
04 同仓库更多 Skills
webapp-risk-triage
USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.
owasp-top10-classifier
USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.
api-security-posture
USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.
os-hardening
USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.
risk-threat-modeling
USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.
regulatory-horizon
USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.