agentic-coding-playbook: Skill for Claude Code

Federal Security Controls Lookup

This skill navigates the federal agentic AI guidance repository to find relevant policy documents, checklist items, and remediation guidance for a given security control, OWASP risk, or keyword.

When to Use

• User asks about a specific NIST control (e.g., "What does AC-6 require?")
• User asks about an OWASP risk (e.g., "How do we handle LLM01 prompt injection?")
• User asks a security question (e.g., "How should we handle secrets?")
• User needs to trace a checklist failure back to guidance
• User needs to understand which controls apply to a topic

Lookup Procedure

Step 1: Classify the Query

Determine which type of lookup the user needs:

Query Pattern	Type	Example
AC-*, AU-*, CM-*, IA-*, IR-*, RA-*, SA-*, SC-*, SI-*, SR-*	NIST Control ID	"AC-6", "SI-10"
LLM01-LLM10	OWASP LLM Risk	"LLM01"
Agentic-01-Agentic-10	OWASP Agentic Risk	"Agentic-05"
Checklist number like 1.1, 5.3	Checklist Item	"item 2.5"
Free text	Keyword Search	"secrets", "input validation"

Step 2: Read the Traceability Matrix

Read docs/TRACEABILITY.md — this is the navigation index for the entire repository.

It contains five mapping tables:

1. NIST Control -> Document sections (Table 1)
2. OWASP LLM Risk -> Controls and sections (Table 2a)
3. OWASP Agentic Risk -> Controls and sections (Table 2b)
4. Checklist Item -> Control and guidance (Table 3, items 1.1-10.6)
5. AI RMF Function -> Documents (Table 4)

Step 3: Follow the Lookup Path

For NIST Control IDs (e.g., AC-6)

1. Find the control in Table 1 of docs/TRACEABILITY.md
2. Note which document sections are referenced (e.g., AGENTS.md §3.1, SECURITY-CONTROLS.md §3.1)
3. Note which checklist items verify this control
4. Read the referenced sections from those documents
5. Present: control name, where guidance lives, what the checklist verifies, key requirements