Agent skill · security · alirezarezvani
senior-security
Check if a design or code is secure: STRIDE threat model, DREAD risk scores, leaked secret scan. Use whenever the user asks what could be attacked, how risky a feature is, or to find exposed keys.
Why this skill is useful
Adds executable scripts for STRIDE threat modeling and secret scanning that provide specific security analysis capabilities.
What it needs
Requires python3 installed locally. About 3k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
Senior Security Engineer — Threat Modeling + Security Router This skill does exactly one job itself — STRIDE/DREAD threat modeling (plus a quick secret scan) — and routes every other security request to the specialist skill that owns that lane. Do not duplicate sibling content here; route instead. Routing Table (read this first) The user wants... Route to Why that skill owns it --- --- --- Vulnerability assessment, pen-test methodology, OWASP Top 10 testing ../security-pen-testing/ Ships vulnerabilityscanner.py + dependencyauditor.py with exit-code contracts Incident triage, SEV classification, forensics, containment ../incident-response/ SEV1–SEV4 taxonomy, NIST SP 800-61 phases, incidenttriage.py Production outage command (non-security incidents) ../incident-commander/ Severity classifier + timeline + postmortem tools Security monitoring, CVE triage SLAs, compliance checks (SOC 2 etc.), security headers ../senior-secops/ securityscanner.py + compliancechecker.py, CVE SLA table Hostile/adversarial code review ../adversarial-reviewer/ 3-persona review with BLOCK/CONCERNS/CLEAN verdict Secure code review as part of general review ../code-reviewer/ Language dispatch + regression fixtures Cloud IAM escalation paths, S3 exposure, security groups ../cloud-security/ cloudposturecheck.py with per-check exit codes Threat hunting, IOC sweeps, anomaly detection ../threat-detection/ z-score anomaly + IOC staleness tooling Red-team engagement planning, ATT&CK kill chains ../red-team/ engagementplanner.py with authorization gate LLM/AI attack surface (prompt injection, poisoning) ../ai-security/ ATLAS-mapped aithreatscanner.py If the request spans lanes (e.g., "secure this new architecture"), do the threat model here first — its output (prioritized threats + mitigations) tells you which siblings to load next. Never bulk-load multiple security skills speculatively. What This Skill Owns: STRIDE Threat Modeling Workflow 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/senior-security--b2ec7d