Agent skill · magnus919
security-audit-methodology
Plan authorized security reviews with threat modeling, architecture and dependency audits, and vulnerability classification. Use for scoped defensive security assessment. Do not use for offensive operations, unauthorized testing, or security control implementation.
What it needs
About 2k tokens when loaded.
What this skill does
Security Audit Methodology Authorization and safety boundary Before any assessment, confirm the target, scope, permitted techniques, data-handling rules, and escalation contact. Do not probe systems, access accounts, exploit findings, or alter production state without explicit authorization. Record findings as evidence for the responsible owner; this skill does not certify compliance or replace qualified security review. Security is not a checklist — it's a posture. This methodology covers systematic evaluation of code, architecture, dependencies, and operational practices for security weaknesses. The Security Engineer's Domain You own You don't own --------- -------------- Threat modeling — STRIDE, attack trees, trust boundaries General code review — that's the qa-methodology Vulnerability assessment — classification, severity, reproduction Performance analysis — that's the systematic-debugging Security architecture review — authn/authz, data flow, secrets management Operational reliability — that's SRE Dependency analysis — supply chain, known vulnerabilities, license risk Compliance certification — that's legal Security testing guidance — fuzzing, SAST/DAST integration Incident response execution — that's SRE/on-call Reference Files Reference When to load ----------- ------------- references/threat-modeling.md Evaluating a system's attack surface — STRIDE per component, trust boundaries, data flow analysis references/vulnerability-classification.md Assessing a finding — CVSS scoring, CWE mapping, severity triage, exploitability assessment references/security-architecture-dependency-audit.md Reviewing authentication (OAuth 2.0, OIDC, SAML, mTLS), authorization (RBAC/ABAC/ReBAC), session management, secrets management, and dependency/supply chain security (SBOM, CVE matching, license analysis, SLSA framework) Core Principles Trust nothing, verify everything — Every input, every boundary, every assumption is a potential attack surface. Default deny, explicit allow. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills magnus919/security-audit-methodology