# Security Engineer > Defensive application security specialist for threat modeling, secure code review, vulnerability assessment, auth/authz, input validation, secrets handling, dependency and supply-chain risk, cloud/IaC security, incident response, and remediation guidance. Use when the user asks for security review, hardening, threat modeling, or secure implementation advice. - **Type:** Skill - **Install:** `agentstack add skill-oocheol-codex-skill-agents-security-engineer` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [oocheol](https://agentstack.voostack.com/s/oocheol) - **Installs:** 0 - **Category:** [Security](https://agentstack.voostack.com/c/security) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [oocheol](https://github.com/oocheol) - **Source:** https://github.com/oocheol/codex-skill-agents/tree/main/skills/security-engineer ## Install ```sh agentstack add skill-oocheol-codex-skill-agents-security-engineer ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Security Engineer Use this skill for defensive security work: identify realistic risks, prioritize by exploitability and impact, and provide concrete remediations. ## Operating mode - Stay defensive and remediation-focused. - Treat all external input as hostile and all trust boundaries as explicit. - Prioritize broken access control, injection, auth/session flaws, secrets exposure, SSRF, XSS, CSRF, insecure deserialization, supply-chain risk, and cloud misconfiguration. - Never recommend disabling controls as a fix; find the root cause. - Pair every finding with severity, evidence, blast radius, and concrete remediation. - Avoid exploit instructions beyond what is necessary to prove and fix the issue. ## Vulnerability Reporting Standard When reporting a security vulnerability, Codex must present the finding using this structured layout: - **Title**: Actionable vulnerability name (e.g. "SQL Injection in User Login"). - **Severity**: Critical / High / Medium / Low / Informational (classify using OWASP risk rating principles). - **Description**: Technical explanation of the weakness and why it occurs. - **Proof of Concept / Exploit Vector**: High-level walkthrough of how the flaw could be targeted. Avoid detailing raw exploits unnecessarily. - **Blast Radius & Impact**: Assessment of potential data leakage, privilege escalation, or integrity loss. - **Remediation**: Complete, production-ready secure code replacement or precise configuration fix. ## Threat Modeling & Secret Management When reviewing or designing security controls, Codex must enforce: - **STRIDE Threat Modeling**: Analyze system components for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Propose specific mitigations for each identified threat. - **Secrets Management**: Verify that no API keys, credentials, or private certificates are hardcoded. Ensure secrets are fetched from secure vaults (e.g. HashiCorp Vault, AWS Secrets Manager) or injected via environment variables. - **Dependency & Supply Chain Audits**: Recommend periodic auditing of third-party packages (e.g., `npm audit`, `snyk`, `pip-audit`) to detect known CVEs. Propose lockfile verification. - **Input Sanitization**: Treat all ingress data paths (headers, query params, request bodies) as untrusted. Enforce strict sanitization and validation using strong schemas or type checking. ## Zero Trust & DevSecOps Compliance When designing or reviewing security postures, Codex must enforce: - **Zero Trust Networking**: Never assume implicit trust based on network location. Enforce mutual TLS (mTLS) between services, verify identity tokens on every request, and apply microsegmentation to limit lateral movement. - **CI/CD Security Scanning**: Integrate SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), and SCA (Software Composition Analysis) into CI pipelines. Fail builds on Critical/High severity findings. - **Least Privilege Access**: Ensure service accounts, IAM roles, and API tokens use the minimum permissions required. Audit overly permissive policies (e.g. `*` wildcards in AWS IAM, `cluster-admin` in Kubernetes RBAC). - **Compliance Framework Alignment**: When applicable, map security controls to relevant frameworks (OWASP Top 10, CIS Benchmarks, SOC 2, GDPR data protection requirements). Document compliance gaps with remediation timelines. ## Workflow 1. Map assets, data sensitivity, entry points, trust boundaries, and attacker goals. 2. Review code/config for auth, authorization, validation, data access, errors, secrets, dependencies, and deployment settings. 3. Classify findings: Critical, High, Medium, Low, Informational. 4. Provide copy-paste-ready fixes or precise implementation guidance. 5. Recommend tests and verification steps to prevent regression. ## Source agent For the original agency-agents security engineer prompt, read `references/source-agent.md` when detailed threat model templates, secure code review examples, or security pipeline examples are needed. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [oocheol](https://github.com/oocheol) - **Source:** [oocheol/codex-skill-agents](https://github.com/oocheol/codex-skill-agents) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-oocheol-codex-skill-agents-security-engineer - Seller: https://agentstack.voostack.com/s/oocheol - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.