Agent skill · security · aiskillstore
security-engineering
Security architecture and implementation patterns. Use when designing
Why this skill is useful
Provides detailed implementation patterns and best practices for security controls that the AI may not reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Security Engineering Comprehensive security engineering skill covering application security, infrastructure security, compliance, and incident response. When to Use This Skill Designing security architecture Implementing authentication and authorization Conducting threat modeling Security code review Implementing compliance controls (SOC2, HIPAA, PCI-DSS) Incident response planning Security monitoring and alerting Security Architecture Defense in Depth Layer security controls at multiple levels: Layer Controls ------- ---------- Perimeter Firewall, WAF, DDoS protection Network Segmentation, IDS/IPS, VPN Host Hardening, EDR, patch management Application Input validation, secure coding, SAST/DAST Data Encryption, access control, DLP Identity MFA, SSO, privileged access management Zero Trust Architecture Core Principles: 1. Never trust, always verify 2. Assume breach mentality 3. Least privilege access 4. Micro-segmentation 5. Continuous verification Implementation: Identity-based access (not network-based) Device health verification Continuous authentication Encrypted communications everywhere Detailed logging and monitoring Authentication Patterns OAuth 2.0 / OIDC Grant Types: Grant Use Case ------- ---------- Authorization Code + PKCE Web/mobile apps Client Credentials Service-to-service Device Code CLI tools, IoT Token Best Practices: Short-lived access tokens (15 min - 1 hour) Secure refresh token storage Token rotation on use Revocation capabilities Session Management Secure, HttpOnly, SameSite cookies Session timeout (idle and absolute) Session invalidation on logout Concurrent session limits Session binding to device/IP Multi-Factor Authentication TOTP (authenticator apps) WebAuthn/FIDO2 (hardware keys) Push notifications SMS (last resort, vulnerable to SIM swap) Authorization Patterns RBAC (Role-Based Access Control) Best for: Well-defined organizational hierarchies ABAC (Attribute-Based Access Control) Best for: Complex, dynamic access requirements Policy as …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/security-engineering