security-assessment_skill

Overview

This skill provides a structured security-assessment workflow for reviewing code, architecture, and infrastructure. It combines threat modeling (STRIDE), OWASP Top 10 review patterns, and secure coding practices to identify and remediate vulnerabilities. Use it to drive repeatable, practical security reviews and threat analyses across the development lifecycle.

How this skill works

The skill inspects architecture diagrams, code diffs, configuration, dependency lists, and CI/CD pipelines to surface risks. It applies STRIDE to classify threats, maps OWASP Top 10 patterns to concrete review steps, and recommends mitigations such as input validation, encryption, and IAM hardening. Outputs are prioritized findings, actionable remediation steps, and verification checks for follow-up.

When to use it

• Code reviews for security-sensitive changes or pull requests
• Designing new features, services, or integrations
• Threat modeling during architecture or sprint planning
• Validating infrastructure, CI/CD, and deployment configurations
• Preparing for security audits, compliance reviews, or pen tests

Best practices

• Perform threat modeling early and update it as design changes
• Automate security checks in CI/CD (SAST, dependency scanning, tests)
• Enforce least privilege for code, services, and cloud IAM
• Validate inputs server-side and apply context-aware output encoding
• Keep secrets out of source control and rotate them regularly

Example use cases

• Reviewing a pull request for injection, auth, and data exposure issues
• Threat modeling a new microservice to identify spoofing and SSRF risks
• Auditing cloud IAM roles and Kubernetes network policies before launch
• Assessing third-party libraries for known CVEs and insecure defaults
• Designing secure session management and token handling for an API