Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vinayaklatthe/microsoft-security-skills --skill security-copilotgit clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/security-copilot)<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/security-copilot"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/security-copilot/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/security-copilot"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/security-copilot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00154 | $0.01608 |
| Opus 5 | $0.00077 | $0.00804 |
| Sonnet 5 | $0.00031 | $0.00322 |
| Haiku 4.5 | $0.00015 | $0.00161 |
Grade A, and why
security-copilot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Microsoft Security Copilot
Microsoft Security Copilot is a generative-AI security platform that helps security and IT teams investigate incidents, hunt threats, summarise findings, and respond at machine speed using natural language, grounded in your security data and Microsoft threat intelligence.
When to use
Accelerating SOC investigation, reporting, and analyst productivity across Microsoft and third-party security data using natural-language workflows.
Do not use this skill for:
- Configuring autonomous triage/remediation agents (use
security-copilot-agents) - Building a SIEM analytics rule (use
sentinel) - Configuring Defender XDR investigations or actions (use
defender-xdr)
Pick the right experience for the task
| Task | Use this experience | Why |
|---|---|---|
| Multi-step investigation across products | Standalone portal | Cross-plugin reasoning, promptbooks |
| Summarise this specific incident | Embedded in Defender XDR | Context already loaded |
| Explain or translate a KQL query | Embedded in Sentinel | Inline in the query editor |
| Explain a Conditional Access policy | Embedded in Entra | Policy already in scope |
| Repeatable investigation pattern | Promptbook | Saved, shareable, parameterised |
| Daily ad-hoc analyst question | Standalone or embedded | Either; pick by where you start |
Rule of thumb: start embedded for single-product questions, switch to standalone the moment you need to correlate across two or more products. Promptbook anything you do more than twice.
Approach
- Provision capacity - Set up Security Compute Units (SCUs) in Azure (provisioned capacity model), assign the Azure subscription and resource group, choose the geographic region, and configure overage settings. SCUs are the meter; underprovisioning throttles, overprovisioning wastes spend. Verify: Security Copilot → Owner settings → Capacity shows SCUs reserved and the region matches your data residency requirement.
- Assign roles - Configure Security Copilot owner and contributor roles in Entra, align to least privilege, set the default environment, and decide on the data sharing toggle (model improvement opt-in/out). Verify: a non-owner test account can use Copilot but cannot change capacity settings.
- Enable plugins - Turn on the Microsoft plugins you need (Defender XDR, Sentinel, Intune, Entra, Threat Intelligence, Purview, Defender for Cloud) and add non-Microsoft or custom plugins where you have third-party data. Copilot respects the underlying product RBAC of the calling user - it never elevates privilege. Verify: a query that requires Sentinel data from a user without Sentinel access returns a permission error, not an answer.
- Choose the experience per workflow - Use the standalone portal for multi-step cross-product investigations, and the embedded experiences inside Defender XDR, Sentinel, Intune, Entra, and Purview for single-product context. Verify: analysts know which surface to start in for their top 5 daily tasks.
- Build promptbooks - Identify your top 5 repeatable workflows (incident summary for exec, reverse-engineer a script, KQL explanation, phishing email triage, CA policy explanation) and turn each into a promptbook with parameters. Verify: each promptbook runs end-to-end on a sample input without manual editing.
- Govern usage and consumption - Monitor SCU consumption per workload, audit Copilot activity, and set alerts on SCU utilisation > 80% to control cost. Review prompt logs for sensitive data exposure. Verify: a usage dashboard exists; alerting fires when SCUs trend high.
- Measure value - Track time-to-first-answer, analyst satisfaction, and SCU per resolved incident before and after rollout. If the metric does not move, the promptbooks or plugins are wrong, not the platform.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 112 lines · 154 tokens per session scan A f3ac317cb3fa
security-copilot is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (172 stars, last pushed 2mo ago), licensed MIT. It adds 154 tokens to every session and 1,608 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
skill-meta-prompt
Craft better prompts using proven optimization techniques — use when your prompt needs refinement.
coding-agents-prompt-authoring
To author, adapt, review, and validate prompts (skills, agents, workflows, rules, etc.) with brief, contracts, and a validation pack.
prompt-enhancer
Transform poor or overly simple prompts with expert-level framing. Use when the user explicitly asks to improve, refine, or rewrite a prompt, or wants help framing a request for another AI system. Do NOT use for authoring, reviewing, or migrating system prompts or skills targeting a specific Claude model…
vendor-prompting
ANALYSIS SKILL — Audit-grade reference for Anthropic Claude and OpenAI GPT-5.6 prompting best practices. WHEN: "claude prompting", "gpt-5.6 prompting", "audit agent", "review prompt", "vendor best practices", "anthropic best practices", "openai prompting". DO NOT USE FOR: routine prompt edits where rules are already…
llm-prompting-guide
Prompt format rules for generative video and music models. Use when writing or reviewing a prompt for MiniMax H3 (text/image/reference-to-video with native audio) or MiniMax Music 3 (song generation from caption plus lyrics), in ComfyUI or elsewhere. Do NOT use for chat-assistant prompts, or for generative models not…
creating-prompts
Creates GitHub Copilot prompt files (.prompt.md) for VS Code. Use when building reusable workflow starters that route work to the right agent, collect the right inputs, and ship with install-ready templates, examples, and validation guidance.