feat(mcsb): add Microsoft Cloud Security Benchmark security skill - #2499

…crosoft#2499)

## Description

This PR adds a new **MCSB** (Microsoft Cloud Security Benchmark v2)
security skill and wires it into the existing security planning and
review workflow. The skill provides a durable control-domain taxonomy
for assessing Azure cloud resources, with crosswalks to *NIST SP 800-53
Rev. 5* and *CIS Controls v8.1*, while deliberately deferring volatile,
per-service control lookups to runtime retrieval.

The change is additive: it introduces the skill and its reference set,
registers it in the relevant collections and generated plugin outputs,
and updates the security agents and standards-mapping instructions so
that MCSB is loaded when Azure cloud resources are detected.

### New MCSB skill

The skill lives under *.github/skills/security/mcsb/* and separates
durable control-domain content from volatile per-service content.

- Added **`.github/skills/security/mcsb/SKILL.md`** as the skill
entrypoint, defining metadata, the normative reference list, the
durable-versus-volatile content distinction, a runtime lookup playbook
reference, the 12 control domains, and stated mappings to *NIST SP
800-53 Rev. 5* and *CIS Controls v8.1*.
- Added **`references/00-control-index.md`** with the domain catalog
(`NS`, `IM`, `PA`, `DP`, `AM`, `LT`, `IR`, `PV`, `ES`, `BR`, `DS`, `AI`)
and a domain-level NIST 800-53 and CIS Controls cross-reference matrix.
- Added **12 domain reference files**, each with an objective,
assessment checklist, controls and mitigations, anti-patterns, a
NIST/CIS crosswalk, and volatile-lookup guidance:
- *01-network-security.md* (NS), *02-identity-management.md* (IM),
*03-privileged-access.md* (PA), *04-data-protection.md* (DP),
*05-asset-management.md* (AM), *06-logging-threat-detection.md* (LT),
*07-incident-response.md* (IR), *08-posture-vulnerability-management.md*
(PV), *09-endpoint-security.md* (ES), *10-backup-recovery.md* (BR),
*11-devops-security.md* (DS), and *12-ai-security.md* (AI).
- The **AI Security** reference notes Security Planner handling when
`raiEnabled` is true.
- Added **`references/lookup-playbook.md`** describing the skill as the
durable control-domain taxonomy with a representative domain-grain
crosswalk, and guidance for retrieving volatile service-specific
controls at runtime.

### Security planning and assessment integration

> Loading MCSB is gated on detecting Azure cloud resources, so non-Azure
workloads are unaffected.

- Updated **`security-planner.agent.md`** to add an Azure cloud
resources trigger that loads the `mcsb` skill in phases 3 and 4, and to
use the MCSB stable control-domain taxonomy and crosswalk in phase 3
while delegating volatile per-service lookups.
- Updated **`security-reviewer.agent.md`** to add `mcsb` to the example
security skills for reference resolution and to the assessable skills
list.
- Updated **`codebase-profiler.agent.md`** to add `mcsb` to skill
resolution examples and to add technology signals for **Azure Bicep**,
**ARM templates**, **Terraform** with the `azurerm` provider,
Azure-targeting **Azure Pipelines**, and Azure service references.
- Updated **`skill-assessor.agent.md`** to add `mcsb` to skill
resolution examples, generalize index handling to support control or
benchmark indexes (including *references/00-control-index.md*), and
treat control-domain identifiers as the assessment grain for benchmark
skills.
- Updated **`standards-mapping.instructions.md`** to delegate only MCSB
*per-service* control mappings, load `mcsb` for Azure cloud resources,
and retain delegation for volatile per-service lookups.

### Collection and plugin registration

- Registered the `mcsb` skill in
**`collections/security.collection.yml`** and
**`collections/hve-core-all.collection.yml`** with `kind: skill` and
`maturity: experimental`.
- Added a describing row in **`collections/security.collection.md`** and
**`collections/hve-core-all.collection.md`**.
- Regenerated plugin outputs: added `mcsb` rows to
**`plugins/security/README.md`** and
**`plugins/hve-core-all/README.md`**, and added the skill symlinks under
both plugin *skills/security/* paths.

## Related Issue(s)

None

## Type of Change

Select all that apply:

**Code & Documentation:**

* [ ] Bug fix (non-breaking change fixing an issue)
* [x] New feature (non-breaking change adding functionality)
* [ ] Breaking change (fix or feature causing existing functionality to
change)
* [ ] Documentation update

**Infrastructure & Configuration:**

* [ ] GitHub Actions workflow
* [ ] Linting configuration (markdown, PowerShell, etc.)
* [ ] Security configuration
* [ ] DevContainer configuration
* [ ] Dependency update

**AI Artifacts:**

* [ ] Reviewed contribution with `prompt-builder` agent and addressed
all feedback
* [x] Copilot instructions (`.github/instructions/*.instructions.md`)
* [ ] Copilot prompt (`.github/prompts/*.prompt.md`)
* [x] Copilot agent (`.github/agents/*.agent.md`)
* [x] Copilot skill (`.github/skills/*/SKILL.md`)
* [ ] Copilot hook (`.github/hooks/*/*.json`)
* [ ] Eval spec added/updated for changed AI artifacts (`evals/`)

> Note for AI Artifact Contributors:
>
> * Agents: Research, indexing/referencing other project (using standard
VS Code GitHub Copilot/MCP tools), planning, and general implementation
agents likely already exist. Review `.github/agents/` before creating
new ones.
> * Skills: Must include both bash and PowerShell scripts. See
[Skills](../docs/contributing/skills.md).
> * Model Versions: Only contributions targeting the **latest Anthropic
and OpenAI models** will be accepted. Older model versions (e.g.,
GPT-3.5, Claude 3) will be rejected.
> * See [Agents Not
Accepted](../docs/contributing/custom-agents.md#agents-not-accepted) and
[Model Version
Requirements](../docs/contributing/ai-artifacts-common.md#model-version-requirements).

**Other:**

* [ ] Script/automation (`.ps1`, `.sh`, `.py`)
* [ ] Other (please describe):

## Sample Prompts (for AI Artifact Contributions)

**User Request:**

> Run a security assessment on this Azure Bicep infrastructure against
the Microsoft Cloud Security Benchmark.

**Execution Flow:**

1. The **codebase-profiler** subagent detects Azure signals (Bicep, ARM,
Terraform `azurerm`, Azure Pipelines, or Azure service references) and
resolves the `mcsb` skill.
2. The **security-planner** agent loads the `mcsb` skill in phases 3 and
4 and uses the stable control-domain taxonomy and NIST/CIS crosswalk,
delegating volatile per-service lookups.
3. The **skill-assessor** subagent reads
*references/00-control-index.md*, treats each control-domain identifier
(`NS`, `IM`, `PA`, and so on) as the assessment grain, and evaluates the
codebase against each domain's checklist, controls, and anti-patterns.
4. Volatile, per-service control specifics are retrieved at runtime per
the lookup playbook rather than from static content.

**Output Artifacts:**

Security planning and review findings organized by MCSB control domain,
each mapped to NIST SP 800-53 Rev. 5 and CIS Controls v8.1 references.
No new files are written to the repository by running the skill; the
skill supplies reference content consumed by the security agents.

**Success Indicators:**

The security planner and reviewer surface MCSB domain identifiers in
their findings, Azure resources trigger MCSB loading, and each finding
cites the corresponding domain reference and framework crosswalk.

> [!NOTE]
> Human review is recommended for the agent-populated Sample Prompts
content above.

## Testing

Automated validation commands run during PR generation:

* `npm run lint:md` — Passed (0 errors).
* `npm run spell-check` — Passed (0 issues).
* `npm run lint:frontmatter` — Passed (848 files, 0 errors).
* `npm run validate:skills` — Passed (`mcsb` and 52 other skills, 0
errors).
* `npm run lint:md-links` — Passed.
* `npm run lint:ps` — Passed (all files clean).
* `npm run eval:lint:schema` — Passed (10 eval specs, coverage
complete).
* `npm run plugin:generate` — Passed; regeneration produced no drift.
* `npm run docs:test` — Skipped; the Docusaurus subproject has no
installed dependencies in this environment (`jest: not found`). No
Docusaurus files were changed.

Security analysis of the diff found no sensitive data, secrets, or
dependency changes. The change is additive documentation-style reference
content with no executable scripts.

Manual testing was not performed.

> [!NOTE]
> Add manual testing descriptions when applicable.

## Checklist

### Required Checks

* [ ] Documentation is updated (if applicable)
* [x] Files follow existing naming conventions
* [x] Changes are backwards compatible (if applicable)
* [ ] Tests added for new functionality (if applicable) (N/A —
reference-content skill with no executable code paths to test)

### AI Artifact Contributions
<!-- If contributing an agent, prompt, instruction, or skill, complete
these checks -->
* [ ] Used `/prompt-analyze` to review contribution
* [ ] Addressed all feedback from `prompt-builder` review
* [ ] Verified contribution follows common standards and type-specific
requirements

### Required Automated Checks

The following validation commands must pass before merging:

* [x] Markdown linting: `npm run lint:md`
* [x] Spell checking: `npm run spell-check`
* [x] Frontmatter validation: `npm run lint:frontmatter`
* [x] Skill structure validation: `npm run validate:skills`
* [x] Link validation: `npm run lint:md-links`
* [x] PowerShell analysis: `npm run lint:ps`
* [x] Eval spec schema and coverage (if AI artifacts changed): `npm run
eval:lint:schema`
* [x] Plugin freshness: `npm run plugin:generate`
* [ ] Docusaurus tests: `npm run docs:test` (Skipped — docs subproject
dependencies not installed in this environment; no Docusaurus files
changed)

## Security Considerations
<!-- ⚠️ WARNING: Do not commit sensitive information such as API keys,
passwords, or personal data -->
* [x] This PR does not contain any sensitive or NDA information
* [ ] Any new dependencies have been reviewed for security issues (N/A —
no dependency changes)
* [ ] Security-related scripts follow the principle of least privilege
(N/A — no security scripts modified)

## GHCP Artifact Maturity

> [!WARNING]
> This PR includes **experimental** GHCP artifacts that may have
breaking changes.
> - `.github/skills/security/mcsb/SKILL.md`

| File | Type | Maturity | Notes |

|------------------------------------------------------|--------------|-----------------|------------------|
| `security/mcsb/SKILL.md` | Skill | ⚠️ experimental | Pre-release only
|
| `security-planner.agent.md` | Agent | ✅ stable | All builds |
| `security-reviewer.agent.md` | Agent | ✅ stable | All builds |
| `subagents/codebase-profiler.agent.md` | Agent | ✅ stable | All builds
|
| `subagents/skill-assessor.agent.md` | Agent | ✅ stable | All builds |
| `standards-mapping.instructions.md` | Instructions | ✅ stable | All
builds |

### GHCP Maturity Acknowledgment
- [ ] I acknowledge this PR includes non-stable GHCP artifacts
- [ ] Non-stable artifacts are intentional for this change

---------

Co-authored-by: Jamie Kim <jamiekim500@gmail.com>
Co-authored-by: Chris Montazer <17170709+rezatnoMsirhC@users.noreply.github.com>