timwukp

Kiro SDLC Scrum Best Practics — Security skill for Claude Code

Security community

Ready-to-use Kiro IDE configurations for enterprise SDLC — Phase-Based (14 roles, 5 phases) and Sprint-Based DevSecOps (Scrum + security shift-left).

How to install Kiro SDLC Scrum Best Practics

This entry records only its repository, not the path inside it, so there is no exact command to give. Open timwukp/Kiro-SDLC-Scrum-best-practics and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Kiro SDLC Scrum Best Practics does

Ready-to-use Kiro IDE configurations for enterprise SDLC — Phase-Based (14 roles, 5 phases) and Sprint-Based DevSecOps (Scrum + security shift-left). Steering, Hooks, Skills, Subagents, MCP/Powers.

Alternatives in Security

Strategy Review — Run a full strategic review — competitive positioning, 7 Powers moat assessment, strategy stack audit, and pre 73 ★
Ops Engineering Skills — Open-source, cross-agent Agent Skills for DevOps, DevSecOps, Cloud, Kubernetes/platform engineering, CI/CD too 36 ★
Fable Skills — Five skills Fable wrote before it left: the security sweep, the setup, the build planner, the honest advisor 34 ★

README

Kiro IDE Best Practices: Phase-Based SDLC vs Sprint-Based DevSecOps

[English](README.md) | [中文](README.zh-CN.md)

**Disclaimer:** This is an unofficial, community-maintained project. It is not affiliated with, endorsed by, or sponsored by AWS or the Kiro team. All configurations, findings, and recommendations are based on publicly available documentation and testing — they do not constitute official guidance. This project is provided "as-is" without warranty of any kind under the [MIT License](./LICENSE). For authoritative information, refer to [kiro.dev/docs](https://kiro.dev/docs/).

Ready-to-use [Kiro IDE](https://kiro.dev) configurations for enterprise software development teams. [Kiro](https://kiro.dev) is an AI-powered IDE that uses steering files, hooks, skills, subagents, and MCP integrations to embed project standards directly into your development workflow.

Two approaches to the same enterprise project — pick the one that matches how your team works:

	Phase-Based SDLC	Sprint-Based DevSecOps
Best for	Teams with linear phases and specialized roles	Scrum teams with cross-functional developers
Work flow	Requirements → Design → Development → Testing → Deployment	2-week Sprints: Plan → Code → Scan → Test → Release → Monitor
Security	Testing phase (near the end)	Every Sprint, every commit (shift-left)
Who owns security	Security Engineer team	Everyone — every developer is a "Security Developer"
AI approach	AI assists each role separately	AI as "Digital Teammate" — security scan triage, threat modeling templates, deployment checklists
Release cadence	After all phases complete	At least once per Sprint
Folder	`phase-based-sdlc-kiro-best-practices/`	`sprint-based-devsecops-kiro-best-practices/`