securityskil
11 skills with substantive source documentation and an official publisher or observed installation demand. Read each skill’s original documentation through its card.
securityskillsstride-threat-modeling
Run a STRIDE-based threat modeling workshop — diagram the system, enumerate threats per element, rank them, and drive mitigations into the backlog. Use during design reviews and new feature planning.
- installs
- 9
- GitHub stars
- 0
- Updated
- Aug 26
securityskillsjwt-security-review
Audit JSON Web Token implementations for algorithm confusion, weak secrets, missing validation, and token lifecycle flaws. Use when a codebase or API uses JWTs for auth.
- installs
- 7
- GitHub stars
- 0
- Updated
- Aug 26
securityskillsagentic-sdlc-controls
Review a development pipeline where AI coding agents write, commit and deploy — permission boundaries, approval gates on irreversible actions, credential scope, and what must never be delegated. Use when agents have write access to a repository or an environment.
- installs
- 2
- GitHub stars
- 0
- Updated
- Aug 26
securityskillsai-change-evidence
Turn changes authored by AI coding agents into evidence an auditor accepts — provenance, authorization, and mapping to change-management controls. Use when agents contribute to code that falls under SOC 2, ISO 27001, PCI DSS or similar.
- installs
- 2
- GitHub stars
- 0
- Updated
- Aug 26
securityskillsnetwork-segmentation-review
Review network segmentation designs and verify enforcement — VLANs, firewalls, cloud security groups, and zero-trust boundaries. Use when assessing internal network architecture.
- installs
- 2
- GitHub stars
- 0
- Updated
- Aug 26
securityskillsowasp-top10-analysis
Systematically review a web application against the OWASP Top 10 vulnerability classes with concrete test cases per category. Use for web app assessments and security gate reviews.
- installs
- 2
- GitHub stars
- 0
- Updated
- Aug 26
securityskillspci-dss-scoping
Scope a PCI DSS environment correctly — cardholder data flows, segmentation validation, and requirements mapping for compliance. Use when preparing for PCI DSS v4.0 assessments.
- installs
- 2
- GitHub stars
- 0
- Updated
- Aug 26
securityskillspentest-engagement-methodology
Execute an authorized penetration test end-to-end, from scoping and rules of engagement through reconnaissance, exploitation, post-exploitation, and reporting. Use when planning or running an offensive security engagement.
- installs
- 2
- GitHub stars
- 0
- Updated
- Aug 26
securityskillssecure-code-review
Perform a security-focused code review — map trust boundaries, audit input paths and auth flows, and use vulnerability-class-driven checklists instead of line-by-line skimming. Use on any PR or codebase with security implications.
- installs
- 2
- GitHub stars
- 0
- Updated
- Aug 26
securityskillscontainer-image-hardening
Harden Dockerfiles and container images — multi-stage builds, non-root users, minimal base images, and vulnerability gates. Use when building production containers or reviewing Dockerfiles.
- installs
- 1
- GitHub stars
- 0
- Updated
- Aug 26
securityskillsssrf-hunting
Find and exploit Server-Side Request Forgery across URL-fetching features, including cloud metadata bypasses and blind SSRF techniques. Use during web assessments and bug bounty hunting.
- installs
- 1
- GitHub stars
- 0
- Updated
- Aug 26