Agent skill · security · borghei
senior-security
STRIDE threat modeling, DREAD risk scoring, secret detection, and secure architecture design. Use when conducting threat models, reviewing code for vulnerabilities, designing defense-in-depth, or scanning for hardcoded secrets.
Why this skill is useful
Adds executable scripts for threat modeling and secret scanning that enhance security assessments beyond standard practices.
What it needs
Requires python installed locally. About 3k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
Senior Security Engineer The agent performs STRIDE threat analysis with DREAD risk scoring, designs defense-in-depth security architectures with Zero Trust principles, conducts secure code reviews against OWASP Top 10, and scans codebases for hardcoded secrets across 20+ credential patterns. Core Capabilities Threat modeling — STRIDE per-element analysis, DREAD risk scoring, DFD creation, attack trees, and mitigation mapping. Security architecture — defense-in-depth layering, Zero Trust, authentication pattern selection (OAuth/OIDC, JWT, mTLS, FIDO2), and encryption strategy. Vulnerability assessment — automated (SAST/DAST/dependency/secret) plus manual testing, OWASP Top 10 mapping, severity classification, and remediation tracking. Secure code review — auth/authz, data handling, and crypto review with a checklist and secure-vs-insecure pattern catalog. Incident response — triage, containment, eradication, recovery, post-mortem, with severity tiers and runbook checklist. Secret detection — secretscanner.py finds 20+ credential patterns (AWS/GCP/Azure, GitHub/Slack/Stripe, private keys); CI/CD-ready exit codes. Compliance mapping — OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, SOC 2 at the application layer. When to Use Conducting a threat model or attack-surface analysis on a system or component. Reviewing code for vulnerabilities before deployment. Designing a secure, defense-in-depth or Zero Trust architecture. Scanning a codebase for hardcoded secrets and credentials. Running a vulnerability assessment or planning incident response. Clarify First Before the threat model or scan, confirm these inputs. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/senior-security