# foundry-security-spec

A skill that walks your agent through implementing Cisco's Foundry spec: a multi-role system for finding and validating vulnerabilities. Useful when you're building your own evaluation pipeline.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 683 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/foundry-security-spec/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/foundry-security-spec

## What it does

Foundry is Cisco's open specification for agentic security evaluation. It lays out eight core agent roles (Orchestrator, Planner, Navigator, Detector, Explorer, Validator, Investigator, Publisher) plus five extension roles that cooperate to surface, confirm and report findings. Nothing gets installed here — it's a blueprint for designing that system around your own project.

The workflow is spec-driven. You read `constitution.md`, which holds 11 principles, then install `@github/spec-kit` so a `.specify/` directory appears in the project. The constitution goes to `.specify/memory/constitution.md` and gets registered with `/speckit.constitution`; the seed spec lands in `specs/001-foundry/spec.md`. From there `/speckit.clarify` asks about your environment — version control, issue tracker, LLM provider, datastore, isolation runtime, deployment target. Once those answers are in, `/speckit.specify`, `/speckit.plan`, `/speckit.tasks` and `/speckit.implement` carry it to code.

Skip `npm` and spec-kit and none of the steps run. The integration questions are yours to answer too; the skill won't guess them. For a first build the spec advises leaving the extension roles out.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill foundry-security-spec -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/foundry-security-spec/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/foundry-security-spec/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill foundry-security-spec -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/foundry-security-spec/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill foundry-security-spec -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/foundry-security-spec/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills foundry-security-spec
```

2. **Manually: put the files in place**
- File: `.github/skills/foundry-security-spec/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill foundry-security-spec -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/foundry-security-spec
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/foundry-security-spec/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill foundry-security-spec -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/foundry-security-spec/SKILL.md

## When to use it
- design a multi-role security evaluation system from scratch
- split vulnerability discovery into stages with evidence checks
- lock project invariants into a constitution before writing code
- connect detection findings to CodeGuard rule format
- produce a spec and task backlog for a security agent

## Example prompts
- Implement the Foundry specification for our security evaluation system, step by step
- Set up the Detector and Validator agent roles from `spec.md`
- Walk me through `/speckit.clarify` and fill in the decisions for our environment

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 24 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md