RFC: Security division naming — security/ vs cybersecurity/

[msitarzewski]

Context

Two open PRs propose security-focused agent divisions with different directory names:

• PR Add Senior SecOps Engineer - Security #326 (@caveat-ops): security/ directory with 1 agent (Senior SecOps Engineer) — focused on defensive code-level security, automatic secrets scanning
• PR Add Cybersecurity Division with 5 specialized agents #223 (@anonym88-ai): cybersecurity/ directory with 5 agents (Penetration Tester, Incident Responder, Cloud Security Architect, Threat Intel Analyst, AppSec Engineer) — comprehensive offensive + defensive division

Additionally, PR #383 (@yoavprat) adds a standalone Penetration Tester to testing/ which overlaps with #223's penetration tester.

Both PRs modify scripts/install.sh, scripts/convert.sh, scripts/lint-agents.sh, and the CI workflow — they can't both merge without coordination.

Questions for the Community

1. Directory name: Should it be security/ or cybersecurity/? Or something else?
2. Scope: Should this be a standalone division, or should security agents live in engineering/ (since we already have engineering-security-engineer.md)?
3. Agent overlap: PR Add Cybersecurity Division with 5 specialized agents #223 includes a Penetration Tester, and PR Add Penetration Tester agent #383 is also a Penetration Tester. Should we keep one, merge the approaches, or differentiate them (e.g., application pentesting vs. infrastructure red teaming)?
4. Division size: Add Cybersecurity Division with 5 specialized agents #223 proposes 5 agents, Add Senior SecOps Engineer - Security #326 proposes 1. Should we combine the best from both?

Please weigh in! Once we align on the approach, the contributors can coordinate and we'll merge.

Ref: PR #326, PR #223, PR #383

[yoavprat]

Hey @msitarzewski — thanks for opening this, good to get alignment before things diverge further.

Here's my take on the four questions:

1. Directory name: security/

Consistent with the repo's convention — short, lowercase, no prefix redundancy (engineering/, testing/, design/). cybersecurity/ works but is unnecessarily long and every filename becomes cybersecurity-cybersecurity-*.md.

2. Scope: standalone division

There are enough distinct specializations (offensive, defensive, IR, cloud, threat intel) to justify a dedicated division. The existing engineering-security-engineer.md is architecture/threat-modeling focused — different domain than operational security agents.

3 + 4. Agent overlap & division composition

I'd propose combining the best from all three PRs:

• PR Add Cybersecurity Division with 5 specialized agents #223's 5 agents as the foundation — it's the most comprehensive, covers both offensive and defensive, and already follows the template. Rename the directory from cybersecurity/ to security/.
• PR Add Senior SecOps Engineer - Security #326's Senior SecOps Engineer as a 6th agent — the auto-scan-on-every-invocation behavior and org-standard anchoring are genuinely unique and don't overlap with Add Cybersecurity Division with 5 specialized agents #223's agents.
• PR Add Penetration Tester agent #383 (mine) — I'll close it. Add Cybersecurity Division with 5 specialized agents #223 already has a Penetration Tester with broader scope (infra + app + cloud). The unique parts of mine are the OWASP WSTG phase structure, human-in-the-loop rules, session state tracking, and SaaS-specific playbooks (IDOR/tenant isolation/vertical escalation). Happy to offer those as enhancements to Add Cybersecurity Division with 5 specialized agents #223's pentester if @anonym88-ai wants to incorporate any of it — but a 7th agent with a similar name isn't the right call.

TL;DR: security/ directory, #223 provides the 5-agent core, #326 adds SecOps as #6, I close #383 and optionally contribute SaaS-specific content upstream into #223's pentester.

Happy to help with the coordination if useful.

[caveat-ops]

Thanks for driving this alignment, @msitarzewski — fully agree with the direction.
I'm on board with the security/ directory and the proposal to combine forces.
My PR #326 (Senior SecOps Engineer) was designed as a defensive, code-level agent with automatic secrets scanning — it complements the broader offensive/defensive scope of #223 nicely, so having it as the 6th agent makes sense.
I'm happy to:

1. Rename my branch/directory to align with security/ if needed
2. Coordinate with @anonym88-ai to ensure our agents don't overlap and follow the same structure
3. Update the scripts and CI changes in Add Senior SecOps Engineer - Security #326 to be compatible with the combined set
   Let me know if you'd like me to hold off on any changes while Add Cybersecurity Division with 5 specialized agents #223 is adjusted, or if there's a specific order in which the PRs should be merged to avoid conflicts.
   Looking forward to getting this sorted! 🚀

[NicoMaker]

I divided files in more files

[anonym88-ai]

Thanks for the proposals! I'm on board with renaming cybersecurity/ to security/ — agree it's more consistent with the repo's naming convention. Happy to rebase my PR with the directory rename. Also open to incorporating the SaaS-specific pentester enhancements from #383 if there's useful content to fold in. Let me know the preferred merge order so I can adjust my branch accordingly and avoid conflicts with #326.

[musaabhasan]

I would use security/ as the directory name and treat cybersecurity as a domain label inside agent metadata rather than the filesystem taxonomy.

Reasoning:

• It matches the shorter naming convention used by most agent catalogs.
• It is broad enough to include AppSec, SecOps, cloud security, incident response, compliance, and offensive testing without forcing a second parallel namespace later.
• It avoids the awkward split where secrets scanning lives under security/ while penetration testing and threat intelligence live under cybersecurity/.

For overlap, I would merge by capability boundaries rather than PR ownership. A clean initial division could be:

• security/appsec-engineer
• security/secops-engineer
• security/incident-responder
• security/cloud-security-architect
• security/threat-intel-analyst
• security/penetration-tester

The standalone penetration tester should not live under testing/ unless it is purely QA-oriented. If it can perform adversarial security assessment, it belongs in security/ with clear guardrails, scope limits, and refusal behavior documented in the agent profile.

[msitarzewski]

✅ Resolved & shipped in #566.

The consensus here is now live: a single security/ division (the 15th), with the directory name everyone agreed on. Final composition (10 agents):

• Add Cybersecurity Division with 5 specialized agents #223's 5 (@anonym88-ai): Application Security Engineer, Cloud Security Architect, Incident Responder, Penetration Tester, Threat Intelligence Analyst
• Add Senior SecOps Engineer - Security #326's (@caveat-ops): Senior SecOps Engineer
• Relocated in: Security Architect (the former engineering-security-engineer, differentiated to architecture/threat-modeling so it doesn't overlap the new AppSec Engineer), Threat Detection Engineer, Compliance Auditor, Blockchain Security Auditor

Per @yoavprat's call, #383 stays closed (its Penetration Tester overlapped #223's). All 10 passed lint + the originality check. #223 and #326 are closed with credit. Thanks everyone for aligning here before the code diverged further. 🔒