senior-security_skill

Overview

This skill is a comprehensive security engineering toolkit for senior practitioners focused on application security, penetration testing, security architecture, cryptography, and compliance auditing. It bundles automated scripts, reference guides, and best-practice workflows to accelerate assessments, hardening, and secure design. Use it to introduce repeatable, production-grade security processes into development and operations.

How this skill works

The skill exposes automated scripts for threat modeling, deep security auditing, and penetration test automation that scan code, configurations, and runtime artifacts. It generates scaffolded threat models, prioritizes findings, offers remediation recommendations and automated fixes where safe, and supports custom configuration for complex environments. Reference guides and patterns explain architecture choices, cryptographic implementations, and testing workflows to help convert findings into concrete design and code changes.

When to use it

• Designing or reviewing security architecture for new systems or major features
• Performing a security audit or automated code/configuration analysis before release
• Running repeatable penetration tests and targeted attack simulations
• Implementing or validating cryptographic components and key management
• Preparing for compliance audits or security assessments

Best practices

• Run threat modeling early and iterate as design changes
• Automate baseline security checks in CI/CD and fail fast on high-risk findings
• Prioritize fixes by likelihood and impact, and track mitigations to closure
• Use vetted cryptographic primitives and centralize key management
• Keep dependencies and tooling up to date and validate tool results with manual review

Example use cases

• Generate a project-specific threat model and actionable checklist before development sprints
• Automate an overnight security audit across a microservice fleet and collect prioritized fix guidance
• Run a scripted penetration test against staging and produce a reproducible report for stakeholders
• Validate cryptographic configurations and migration plans during a platform upgrade
• Integrate security auditor into CI to prevent regressions and enforce guardrails