Microsoft Security Skills plugin
A plugin with 88 Microsoft security skills: Defender, Sentinel, Entra, Purview and Intune for Copilot, Claude Code and Cursor.
- 180 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- The skills give documentation-based advice and run nothing in your tenant.
Install
- Works in
Manual install
apm install vinayaklatthe/microsoft-security-skillsA single APM call places the package into the supported hosts.
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The skills give documentation-based advice and run nothing in your tenant.
This is third-party code. Review the repository files before installing.
What it does
The Microsoft Security Skills Plugin packages Microsoft security expertise into 88 skills for coding agents. Instead of generic advice the agent leans on workflows, decision trees and guardrails from public Microsoft Learn documentation, with no proprietary material. Skills are grouped by area: threat protection and SecOps (`defender-xdr`, `sentinel`, `threat-modelling` and others), identity and access (`entra-id`, `conditional-access-mfa`, `azure-pim`, `passkeys-fido2`), compliance and data protection (Purview DLP, eDiscovery, Insider Risk), AI and agent security, and device management through Intune. It is a knowledge pack for an existing agent and has no CLI of its own. GitHub Copilot, Claude Code, Cursor, Codex CLI and Gemini CLI are supported. The authors measure the lift of each skill with a reproducible harness that compares answers with a model without the skill.
Who it is for. Security engineers and Microsoft 365 and Azure admins who configure protection with an agent and want to rely on vendor documentation.
Good fit when
- Before enabling a Conditional Access policy you must check it will not lock out admins.
- A Defender XDR investigation needs a path from alert to cause.
- A DLP policy in Purview must be set up and you need to know what to check first.
- An audit of AI agent rights and access in Microsoft 365 is being prepared.
Not a fit when
- You need live queries against a tenant: the pack holds knowledge and does not connect to your systems.
- Your security is built on non-Microsoft products.
- You need a legal opinion on compliance.
Example request
Walk me through safely introducing a Conditional Access policy with mandatory MFA for admins and list the checks before enabling it.Limitations
This is a knowledge pack: it advises from Microsoft Learn documentation and connects nothing to your tenant. Live queries against logs or policies need a separate MCP server, as the README notes. Before installing, make sure you are signed in to the host itself: a host folder on disk does not mean a working agent. An APM install may report a target as active based on a found folder even when the CLI is missing. Check security configuration advice on a test environment first.
How to disable. Remove the skills with your manager command (`npx skills remove` or `apm uninstall`) or delete the plugin directory from the host skills folder.
FAQ
How do I install into all hosts at once?
With `apm install vinayaklatthe/microsoft-security-skills`: APM places the package into GitHub Copilot, Claude Code, Cursor, OpenCode, Codex and Gemini. Install and sign in to a host first.
How do I install in Claude Code without APM?
With `npx skills add https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills -a claude -g -y`. Git and Node.js 18 are required.
Which areas are covered?
Threat protection and SecOps, identity and governance, compliance and privacy, cloud security, AI and agent security, and devices and apps through Intune.
Is there a standalone CLI?
No. The package works only through the chat of an installed host.
Where does the knowledge come from?
From public Microsoft Learn documentation. The skills contain no proprietary content.
Discussion
No questions or reviews yet.
Related
PluginsCybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
A code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
The SecKnowledge skill loads a web-vulnerability and AI-app risk knowledge base into an agent for security testing of a target.
README in short
The repository explains that the package is a set of skills and not a standalone agent and lists 88 skills by area. It describes prerequisites, installation through APM and the skills CLI, a Gemini extension and a test harness validating the skills lift.