Security

Shift-left security: identify and mitigate threats before code is written.

Workflow Routing

Examples

Example 1: Threat model a new feature

User: "Threat model the user login feature"
Skill loads: Security → ThreatModel workflow
Output: STRIDE threats identified (spoofing, tampering, etc.) with mitigations

Example 2: Generate CMMC baseline

User: "Create CMMC baseline for our e-commerce app"
Skill loads: Security → CmmcBaseline workflow
Output: CMMC practices mapped to features, gap analysis, compliance roadmap

Example 3: Code security review

User: "Review this authentication code for security vulnerabilities"
Skill loads: Security → SecurityReview workflow
Output: OWASP Top 10 analysis, vulnerability findings (SQL injection, weak passwords), remediation guidance

Example 4: Infrastructure security audit

User: "Audit our AWS configuration for security issues"
Skill loads: Security → InfrastructureSecurity workflow
Output: Infrastructure security findings (open S3 buckets, weak IAM policies), CIS Benchmark gaps

Integration

• Works with AgilePm skill (adds security reqs to user stories)
• Works with TestArchitect skill (security test scenarios from threat model)
• Generates threat-model.md for project documentation
• Maps to CMMC practices for compliance

Methodology

This skill follows security-first principles:

• Threat model during design (not after deployment)
• STRIDE methodology (Microsoft's threat modeling framework)
• CMMC Level 2 baseline (110 practices for DoD contractors)
• Risk-based prioritization (fix critical threats first)

Based on industry standards: STRIDE, OWASP Top 10, CMMC Model v2.0.