Security Arch Review
Use this skill to conduct a structured security architecture and code review against the OWASP Top 10 Proactive Controls. Reviews staged files or the full codebase, reads existing security-audit/threat-model.md and security-audit/security-scan-report.md to focus and contextualise findings, and produces a security-audit/security-arch-review-report.md with Pass/Partial/Fail per control and code-lev…
Threat Model
Use this skill to create or update a STRIDE-based threat model for an application. Analyses the codebase to map components, data flows, trust boundaries, and assets, then enumerates threats using STRIDE and OWASP frameworks, scores risk, and maps remediations. Produces a living security-audit/threat-model.md (Mermaid diagrams included) that is updated incrementally on re-runs. Invoke as `/threat-…
Security Audit
Orchestrates a full security audit by running all three security sub-skills in sequence: security-scan (SAST + secrets), threat-model (STRIDE architecture analysis), and security-arch-review (OWASP Proactive Controls code review). Produces individual reports from each sub-skill plus a consolidated report in the `security-audit/` folder. Invoke as `/security-audit` for staged files, `/security-aud…
Security Scan
Use this skill to run a security scan combining SAST analysis, secret/credential detection, dependency vulnerability scanning (SCA), and container/IaC misconfiguration checks on staged code or the full codebase. Invoke as `/security-scan` to scan only git-staged files (fast, pre-commit use), or `/security-scan full` to scan the entire codebase. Uses semgrep or opengrep for SAST, trufflehog for se…