feat(mcsb): add Microsoft Cloud Security Benchmark security skill

[nguyena2]

Description

This PR adds a new MCSB (Microsoft Cloud Security Benchmark v2) security skill and wires it into the existing security planning and review workflow. The skill provides a durable control-domain taxonomy for assessing Azure cloud resources, with crosswalks to NIST SP 800-53 Rev. 5 and CIS Controls v8.1, while deliberately deferring volatile, per-service control lookups to runtime retrieval.

The change is additive: it introduces the skill and its reference set, registers it in the relevant collections and generated plugin outputs, and updates the security agents and standards-mapping instructions so that MCSB is loaded when Azure cloud resources are detected.

New MCSB skill

The skill lives under .github/skills/security/mcsb/ and separates durable control-domain content from volatile per-service content.

• Added .github/skills/security/mcsb/SKILL.md as the skill entrypoint, defining metadata, the normative reference list, the durable-versus-volatile content distinction, a runtime lookup playbook reference, the 12 control domains, and stated mappings to NIST SP 800-53 Rev. 5 and CIS Controls v8.1.
• Added references/00-control-index.md with the domain catalog (NS, IM, PA, DP, AM, LT, IR, PV, ES, BR, DS, AI) and a domain-level NIST 800-53 and CIS Controls cross-reference matrix.
• Added 12 domain reference files, each with an objective, assessment checklist, controls and mitigations, anti-patterns, a NIST/CIS crosswalk, and volatile-lookup guidance:
  • 01-network-security.md (NS), 02-identity-management.md (IM), 03-privileged-access.md (PA), 04-data-protection.md (DP), 05-asset-management.md (AM), 06-logging-threat-detection.md (LT), 07-incident-response.md (IR), 08-posture-vulnerability-management.md (PV), 09-endpoint-security.md (ES), 10-backup-recovery.md (BR), 11-devops-security.md (DS), and 12-ai-security.md (AI).
  • The AI Security reference notes Security Planner handling when raiEnabled is true.
• Added references/lookup-playbook.md describing the skill as the durable control-domain taxonomy with a representative domain-grain crosswalk, and guidance for retrieving volatile service-specific controls at runtime.

Security planning and assessment integration

Loading MCSB is gated on detecting Azure cloud resources, so non-Azure workloads are unaffected.

• Updated security-planner.agent.md to add an Azure cloud resources trigger that loads the mcsb skill in phases 3 and 4, and to use the MCSB stable control-domain taxonomy and crosswalk in phase 3 while delegating volatile per-service lookups.
• Updated security-reviewer.agent.md to add mcsb to the example security skills for reference resolution and to the assessable skills list.
• Updated codebase-profiler.agent.md to add mcsb to skill resolution examples and to add technology signals for Azure Bicep, ARM templates, Terraform with the azurerm provider, Azure-targeting Azure Pipelines, and Azure service references.
• Updated skill-assessor.agent.md to add mcsb to skill resolution examples, generalize index handling to support control or benchmark indexes (including references/00-control-index.md), and treat control-domain identifiers as the assessment grain for benchmark skills.
• Updated standards-mapping.instructions.md to delegate only MCSB per-service control mappings, load mcsb for Azure cloud resources, and retain delegation for volatile per-service lookups.

Collection and plugin registration

• Registered the mcsb skill in collections/security.collection.yml and collections/hve-core-all.collection.yml with kind: skill and maturity: experimental.
• Added a describing row in collections/security.collection.md and collections/hve-core-all.collection.md.
• Regenerated plugin outputs: added mcsb rows to plugins/security/README.md and plugins/hve-core-all/README.md, and added the skill symlinks under both plugin skills/security/ paths.

Related Issue(s)

None

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with prompt-builder agent and addressed all feedback
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)
• Copilot hook (.github/hooks/*/*.json)
• Eval spec added/updated for changed AI artifacts (evals/)

Note for AI Artifact Contributors:

• Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
• Skills: Must include both bash and PowerShell scripts. See Skills.
• Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.
• See Agents Not Accepted and Model Version Requirements.

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Sample Prompts (for AI Artifact Contributions)

User Request:

Run a security assessment on this Azure Bicep infrastructure against the Microsoft Cloud Security Benchmark.

Execution Flow:

1. The codebase-profiler subagent detects Azure signals (Bicep, ARM, Terraform azurerm, Azure Pipelines, or Azure service references) and resolves the mcsb skill.
2. The security-planner agent loads the mcsb skill in phases 3 and 4 and uses the stable control-domain taxonomy and NIST/CIS crosswalk, delegating volatile per-service lookups.
3. The skill-assessor subagent reads references/00-control-index.md, treats each control-domain identifier (NS, IM, PA, and so on) as the assessment grain, and evaluates the codebase against each domain's checklist, controls, and anti-patterns.
4. Volatile, per-service control specifics are retrieved at runtime per the lookup playbook rather than from static content.

Output Artifacts:

Security planning and review findings organized by MCSB control domain, each mapped to NIST SP 800-53 Rev. 5 and CIS Controls v8.1 references. No new files are written to the repository by running the skill; the skill supplies reference content consumed by the security agents.

Success Indicators:

The security planner and reviewer surface MCSB domain identifiers in their findings, Azure resources trigger MCSB loading, and each finding cites the corresponding domain reference and framework crosswalk.

Note

Human review is recommended for the agent-populated Sample Prompts content above.

Testing

Automated validation commands run during PR generation:

• npm run lint:md — Passed (0 errors).
• npm run spell-check — Passed (0 issues).
• npm run lint:frontmatter — Passed (848 files, 0 errors).
• npm run validate:skills — Passed (mcsb and 52 other skills, 0 errors).
• npm run lint:md-links — Passed.
• npm run lint:ps — Passed (all files clean).
• npm run eval:lint:schema — Passed (10 eval specs, coverage complete).
• npm run plugin:generate — Passed; regeneration produced no drift.
• npm run docs:test — Skipped; the Docusaurus subproject has no installed dependencies in this environment (jest: not found). No Docusaurus files were changed.

Security analysis of the diff found no sensitive data, secrets, or dependency changes. The change is additive documentation-style reference content with no executable scripts.

Manual testing was not performed.

Note

Add manual testing descriptions when applicable.

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable) (N/A — reference-content skill with no executable code paths to test)

AI Artifact Contributions

• Used /prompt-analyze to review contribution
• Addressed all feedback from prompt-builder review
• Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Skill structure validation: npm run validate:skills
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps
• Eval spec schema and coverage (if AI artifacts changed): npm run eval:lint:schema
• Plugin freshness: npm run plugin:generate
• Docusaurus tests: npm run docs:test (Skipped — docs subproject dependencies not installed in this environment; no Docusaurus files changed)

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues (N/A — no dependency changes)
• Security-related scripts follow the principle of least privilege (N/A — no security scripts modified)

GHCP Artifact Maturity

Warning

This PR includes experimental GHCP artifacts that may have breaking changes.

• .github/skills/security/mcsb/SKILL.md

File	Type	Maturity	Notes
security/mcsb/SKILL.md	Skill	⚠️ experimental	Pre-release only
security-planner.agent.md	Agent	✅ stable	All builds
security-reviewer.agent.md	Agent	✅ stable	All builds
subagents/codebase-profiler.agent.md	Agent	✅ stable	All builds
subagents/skill-assessor.agent.md	Agent	✅ stable	All builds
standards-mapping.instructions.md	Instructions	✅ stable	All builds

GHCP Maturity Acknowledgment

• I acknowledge this PR includes non-stable GHCP artifacts
• Non-stable artifacts are intentional for this change

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.74%. Comparing base (8ae6195) to head (d1f8b48).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2499      +/-   ##
==========================================
- Coverage   82.76%   82.74%   -0.02%     
==========================================
  Files         154      154              
  Lines       20853    20839      -14     
  Branches       13       13              
==========================================
- Hits        17259    17244      -15     
- Misses       3592     3593       +1     
  Partials        2        2              

Flag	Coverage Δ
docusaurus	94.44% <ø> (ø)
pester	86.26% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Eval Execution

⚠️ No eval summary was produced.

[rezatnoMsirhC]

The skill content is well-structured and follows the reference-skill pattern. Before merging, could you run the hve-builder review on SKILL.md (static analysis mode) and attach the findings artifact to this PR? For a skill being loaded by the security planner and reviewer agents, the rubric check is part of the standard authoring gate.

[rezatnoMsirhC]

Please verify the license that governs the MCSB source content at learn.microsoft.com/en-us/security/benchmark/azure/. If the page footer shows CC BY 4.0 (which is common for azure-docs-sourced content), the claim here that it is "not a Creative Commons license" would be incorrect, and a formal CC BY attribution block would be required per the repo licensing posture (see .github/instructions/hve-core/licensing-posture.instructions.md). If it genuinely is governed by the Microsoft Learn Terms of Use only, the current text is correct as written.