AI Coding Agent Security Skills for Security Teams

Security teams should treat AI coding agents as power tools: useful every day, dangerous when unconstrained, and most valuable when wrapped in repeatable skills. Antigravity CLI, GitHub Copilot CLI, Claude Code, and OpenAI Codex can all help defenders review code, explain risky diffs, triage dependency issues, write tests, and prepare fixes. The safe pattern is not to give every agent unlimited access. The safe pattern is to give each agent a narrow workflow, a clear trust boundary, and evidence requirements.

Quick comparison

Daily skills to standardize

1. `/review-pr-security`

Review the current pull request for authentication, authorization, cryptography, deserialization, dependency, CI/CD, logging, data exposure, and secrets risk. Require file-level evidence, severity, exploitability notes, and test suggestions. Do not approve or merge.

1. `/audit-ci-cd`

Inspect GitHub Actions, deployment scripts, package publishing, artifact handling, runner permissions, OIDC trust, and secret usage. Flag broad permissions, unpinned third-party actions, unsafe pull-request triggers, and deployment paths without environment protection.

1. `/triage-dependencies`

Cluster dependency findings by exploitability, runtime exposure, package role, maintainer risk, availability of fixed versions, and whether the vulnerable path is reachable. Produce a patch order rather than a giant vulnerability dump.

1. `/write-safe-fix`

Generate the smallest defensible patch for one verified issue, add or update regression tests, and explain residual risk. Keep package upgrades, config rewrites, and broad refactors out of scope unless explicitly approved.

1. `/threat-model-change`

Turn a design doc, diff, or feature branch into assets, actors, trust boundaries, abuse cases, missing controls, and concrete security questions. Prefer practical engineering questions over generic STRIDE filler.

1. `/incident-code-timeline`

Summarize code changes, deployments, CI runs, alerts, logs, and ticket notes into a timeline with confidence labels. Separate confirmed facts from hypotheses and preserve links back to the system of record.

1. `/agent-permission-review`

Review agent configuration, MCP servers, CLI permissions, environment variables, shell access, network access, credential storage, and approval defaults. Recommend the smallest permission set that still supports the workflow.

Antigravity CLI security workflow

Use Antigravity CLI for terminal-based autonomous analysis where a security engineer wants local control and explicit permission boundaries. The key pattern is to define fine-grained permissions before the agent starts touching code. Its docs describe permission resources as `action(target)`, which maps well to security-team allowlists and denylists.

Good default skill:

```text Run a read-only security review of this repository. Use search, file reads, and safe static inspection only. Do not edit files, install packages, run network calls, or execute project scripts unless I approve. Return findings with file paths, evidence, exploitability, and a minimal validation command. ```

Use Antigravity CLI when the task is local, terminal-heavy, and benefits from explicit path and command rules. Avoid using it from broad directories like a home folder, credential folder, or mixed-client workspace.

GitHub Copilot CLI security workflow

Use GitHub Copilot CLI when the security task is closely tied to GitHub issues, pull requests, local repository work, and terminal commands. GitHub documents plan mode, trusted directories, local/cloud sandboxing, and per-tool controls such as `--allow-tool` and `--deny-tool`.

Safer startup pattern:

```bash copilot --available-tools='bash,edit,view,grep,glob' \ --allow-tool='shell(git:*)' \ --allow-tool='shell(npm run test:*)' \ --deny-tool='shell(git push)' ```

Use this for PR review preparation, test generation, dependency triage, and issue summarization. Avoid `--allow-all`, `--allow-all-tools`, or `/yolo` unless the session is isolated in a sandbox or disposable environment.

Claude Code security workflow

Use Claude Code when the team wants reusable security skills as project artifacts. Claude Code skills live in places like `.claude/skills/<skill-name>/SKILL.md` for a project or `~/.claude/skills/<skill-name>/SKILL.md` for a user. That makes it a natural fit for AppSec playbooks that should travel with a repository.

Project skill pattern:

```text .claude/skills/review-pr-security/SKILL.md .claude/skills/audit-github-actions/SKILL.md .claude/skills/triage-secrets/SKILL.md .claude/skills/threat-model-feature/SKILL.md ```

Keep each skill narrow. Add `disable-model-invocation: true` for sensitive workflows that should only run when a human invokes them directly. Review skill files like code because malicious or sloppy skill instructions can become a supply-chain risk.

OpenAI Codex security workflow

Use Codex for long-horizon engineering tasks where the security team wants code changes, tests, and reviewable diffs. OpenAI describes Codex use cases such as understanding large codebases, remediating a vulnerability backlog, adding evals, auditing dependency incidents, and building workflows as skills. Codex is strongest when you give it a concrete objective and require verification before shipping.

Good Codex prompt pattern:

```text Find the smallest safe fix for this verified vulnerability. First inspect the affected code path and propose a plan. Do not change unrelated files. Add a regression test. Run the relevant test/build command. Summarize the diff, risk, and remaining manual review required. ```

For OpenAI API-backed agentic coding products, GPT-5.2-Codex is documented as a coding-optimized model for long-horizon, agentic coding tasks in Codex-like environments. For site operations, keep the workflow human-reviewed: Codex can prepare fixes, but merge, deploy, production credential changes, and package publishing should remain gated.

Minimum enterprise policy

• Require a trusted workspace for every coding-agent session.
• Keep read-only analysis as the default mode.
• Approve edits, shell execution, network access, package installs, and Git writes separately.
• Block agents from reading `.env`, private keys, password stores, and production secrets.
• Log prompts, tool calls, file edits, commands, test results, and final reviewers.
• Prefer short-lived tokens and workload identities over personal access tokens.
• Run untrusted repositories in containers, VMs, cloud sandboxes, or local sandbox modes.
• Require every AI-generated security finding to include evidence and reproducibility steps.
• Treat agent skills, MCP servers, and helper scripts as reviewed supply-chain artifacts.
• Never let an AI agent self-approve, self-merge, self-deploy, or rotate production credentials without human authorization.

Recommended rollout

Start with read-only workflows: PR security summaries, CI/CD audit notes, dependency prioritization, and threat-model drafts. Then allow bounded file edits for low-risk fixes with tests. Only after the team has evidence of accuracy, logging, rollback, and reviewer discipline should you consider semi-autonomous remediation.

The operating model is simple: let AI coding agents move fast where the blast radius is low, and force deliberate human approval where the blast radius is high. That is how security teams get leverage without handing the keyboard to a tiny chaos raccoon wearing a hoodie.

Sources

• Google Antigravity CLI permissions
• Google Antigravity CLI installation and auth
• GitHub Copilot CLI overview
• GitHub Copilot CLI tool allow and deny controls
• Claude Code skills documentation
• Claude Code extension overview
• OpenAI Codex use cases
• OpenAI GPT-5.2-Codex model documentation