examples: Skill for Claude Code

flowchart TD
    START(["/orchestrate:security"]) --> READ["Read plan + scan report"]:::orch
    READ --> CODEOWNERS["Create CODEOWNERS"]:::orch
    CODEOWNERS --> SECURITY_MD["Create SECURITY.md"]:::orch
    SECURITY_MD --> CONTRIBUTING["Create CONTRIBUTING.md"]:::orch
    CONTRIBUTING --> LICENSE["Verify/add LICENSE"]:::orch
    LICENSE --> GITIGNORE["Audit .gitignore"]:::orch
    GITIGNORE --> BRANCH_PROT["Document branch protection"]:::orch
    BRANCH_PROT --> BRANCH["Create branch"]:::orch
    BRANCH --> SIZE{Under 700 lines?}
    SIZE -->|Yes| PR["Commit + open PR"]:::orch
    SIZE -->|No| SPLIT["Split into sub-PRs"]:::orch
    SPLIT --> PR
    PR --> DONE([Phase complete])

    classDef orch fill:#FF9800,stroke:#333,color:white

Follow this diagram as the workflow.

Orchestrate: Security Governance

Add security governance files to a target repository. This is Phase 5 and produces PR #4. Focuses on governance and policy files — CI-related security (scanning, dependabot, scorecard) is handled by orchestrate:ci.

When to Use

• After orchestrate:plan identifies security governance as a needed phase
• After precommit, tests, and CI phases

Prerequisites

• Plan exists with security phase
• Scan report exists (to know what's missing)
• Target repo in .repos/<target>/

Step 1: CODEOWNERS

Create CODEOWNERS at repo root or .github/CODEOWNERS:

# Default owners for everything
* @org/team-leads

# Platform and CI
.github/ @org/platform
Makefile @org/platform

# Documentation
docs/ @org/docs-team
*.md @org/docs-team

Adapt teams and paths based on:

• The scan report's identified tech stack
• The org's team structure (check other repos for patterns)
• Key directories that need specialized review

Step 2: SECURITY.md

Create SECURITY.md with vulnerability reporting guidance:

# Security Policy

## Reporting a Vulnerability

Please report security vulnerabilities through GitHub Security Advisories:
**[Report a vulnerability](https://github.com/org/repo/security/advisories/new)**

Do NOT open public issues for security vulnerabilities.

## Response Timeline

- **Acknowledgment:** Within 48 hours
- **Initial assessment:** Within 7 days
- **Fix timeline:** Based on severity

## Security Controls

This repository uses:
- CI security scanning (Trivy, CodeQL)
- Dependency updates via Dependabot
- OpenSSF Scorecard monitoring
- Pre-commit hooks for local checks