[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C2Y2XKC826N40ASR9WE3BZ":3,"skill-same:01M6C2Y2XKC826N40ASR9WE3BZ":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6C2Y2XKC826N40ASR9WE3BZ","security-assessment",null,"Execute STRIDE threat modeling, vulnerability scanning, and security control validation with risk scoring","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fcodex-sdlc\u002Fskills\u002Fsecurity-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"security","assessment","security assessment","scoped","review","path","with","control","modeling","me","scoring","threat","scanning","execute","find","stride","vulnerability","risk","start","vulnerability scanning","validation","help","security review","risk scoring","threat modeling","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: security-assessment\nplatforms: [all]\ndescription: Execute STRIDE threat modeling, vulnerability scanning, and security control validation with risk scoring\ntriggers:\n  - \"help with security\"\n  - \"help me find the right security review path\"\n  - \"start with a scoped security assessment\"\n  - \"security assessment\"\n\n---\n\n# security-assessment\n\nExecute threat modeling, vulnerability scanning, and security control validation.\n\n## Triggers\n\n\nAlternate expressions and non-obvious activations (primary phrases are matched automatically from the skill description):\n\n- \"STRIDE [component]\" → threat model using STRIDE framework\n- \"OWASP check\" → OWASP Top 10 validation\n- \"SAST\" \u002F \"DAST\" → static\u002Fdynamic application security testing\n- \"CVE scan\" → known vulnerability enumeration\n- \"is the code safe\" → colloquial security check\n- \"pentest prep\" → pre-penetration-test readiness\n\n## Purpose\n\nThis skill orchestrates comprehensive security assessment through:\n- STRIDE threat modeling\n- Vulnerability pattern detection\n- Security control validation\n- Compliance verification\n- Risk scoring and prioritization\n\n## Behavior\n\nWhen triggered, this skill:\n\n1. **Determines scope**:\n   - Component-level, system-level, or full assessment\n   - Identify assets and trust boundaries\n   - Load existing threat model if available\n\n2. **Executes threat modeling**:\n   - Dispatch Security Architect for STRIDE analysis\n   - Enumerate threats per component\n   - Identify attack vectors\n\n3. **Runs vulnerability patterns**:\n   - Dispatch Security Auditor for pattern scanning\n   - Check OWASP Top 10\n   - Identify secrets exposure risks\n   - Review dependency vulnerabilities\n\n4. **Validates controls**:\n   - Dispatch Security Gatekeeper\n   - Map controls to threats\n   - Verify implementation\n   - Check coverage gaps\n\n5. **Assesses privacy**:\n   - Dispatch Privacy Officer (if PII involved)\n   - Check data handling\n   - Verify consent mechanisms\n\n6. **Generates report**:\n   - Risk-ranked findings\n   - CVSS scores where applicable\n   - Remediation guidance\n   - Compliance status\n\n## STRIDE Threat Categories\n\n| Category | Description | Example |\n|----------|-------------|---------|\n| **S**poofing | Impersonating something\u002Fsomeone | Fake user credentials |\n| **T**ampering | Modifying data or code | SQL injection |\n| **R**epudiation | Denying actions | Missing audit logs |\n| **I**nformation Disclosure | Exposing information | Data leakage |\n| **D**enial of Service | Disrupting availability | Resource exhaustion |\n| **E**levation of Privilege | Gaining unauthorized access | Broken access control |\n\n## Assessment Flow\n\n```\n┌─────────────────────────────────────────────────────────┐\n│ 1. SCOPE IDENTIFICATION                                 │\n│    • Define assessment boundary                         │\n│    • Identify assets (data, services, infrastructure)   │\n│    • Map trust boundaries                               │\n│    • Load existing threat model (if any)                │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 2. THREAT MODELING (Security Architect)                 │\n│    • Data flow analysis                                 │\n│    • STRIDE enumeration per component                   │\n│    • Attack vector identification                       │\n│    • Trust boundary crossing analysis                   │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 3. VULNERABILITY SCANNING (Security Auditor)            │\n│    • OWASP Top 10 pattern check                         │\n│    • Secrets exposure scan                              │\n│    • Dependency vulnerability check                     │\n│    • Configuration review                               │\n│    • Code pattern analysis                              │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 4. CONTROL VALIDATION (Security Gatekeeper)             │\n│    • Map security requirements to controls              │\n│    • Verify control implementation                      │\n│    • Check control effectiveness                        │\n│    • Identify coverage gaps                             │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 5. PRIVACY ASSESSMENT (Privacy Officer) [if PII]        │\n│    • Data inventory review                              │\n│    • Consent mechanism validation                       │\n│    • Data retention compliance                          │\n│    • Cross-border transfer assessment                   │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 6. RISK SCORING & REPORTING                             │\n│    • Calculate CVSS scores                              │\n│    • Prioritize by risk (likelihood × impact)           │\n│    • Generate remediation guidance                      │\n│    • Produce assessment report                          │\n└─────────────────────────────────────────────────────────┘\n```\n\n## OWASP Top 10 Checks\n\n| # | Category | Patterns Checked |\n|---|----------|-----------------|\n| A01 | Broken Access Control | RBAC, ABAC, path traversal, CORS |\n| A02 | Cryptographic Failures | Weak algorithms, key management, TLS |\n| A03 | Injection | SQL, NoSQL, LDAP, OS command, XSS |\n| A04 | Insecure Design | Threat modeling gaps, missing controls |\n| A05 | Security Misconfiguration | Defaults, unnecessary features, verbose errors |\n| A06 | Vulnerable Components | Outdated dependencies, known CVEs |\n| A07 | Auth Failures | Password policies, MFA, session management |\n| A08 | Data Integrity Failures | CI\u002FCD security, unsigned updates |\n| A09 | Logging Failures | Missing logs, sensitive data in logs |\n| A10 | SSRF | Internal resource access, URL validation |\n\n## Severity Scoring\n\n### CVSS Base Metrics\n\n```yaml\nseverity_levels:\n  critical:\n    cvss_range: [9.0, 10.0]\n    description: Immediate remediation required\n    sla: 24 hours\n\n  high:\n    cvss_range: [7.0, 8.9]\n    description: Remediation within sprint\n    sla: 7 days\n\n  medium:\n    cvss_range: [4.0, 6.9]\n    description: Plan remediation\n    sla: 30 days\n\n  low:\n    cvss_range: [0.1, 3.9]\n    description: Address as time permits\n    sla: 90 days\n\n  informational:\n    cvss_range: [0.0, 0.0]\n    description: Awareness only\n    sla: none\n```\n\n## Assessment Report Format\n\n```markdown\n# Security Assessment Report\n\n**Date**: 2025-12-08\n**Scope**: Full System Assessment\n**Assessors**: security-architect, security-auditor, security-gatekeeper\n\n## Executive Summary\n\n| Severity | Count |\n|----------|-------|\n| Critical | 0 |\n| High | 2 |\n| Medium | 5 |\n| Low | 8 |\n| Informational | 3 |\n\n**Overall Risk Level**: MEDIUM\n**Recommendation**: Address high-severity findings before production deployment\n\n## Threat Model Summary\n\n### Trust Boundaries\n1. External → API Gateway\n2. API Gateway → Internal Services\n3. Services → Database\n\n### STRIDE Analysis\n\n| Component | S | T | R | I | D | E | Total |\n|-----------|---|---|---|---|---|---|-------|\n| API Gateway | 2 | 1 | 0 | 1 | 1 | 1 | 6 |\n| Auth Service | 3 | 1 | 1 | 2 | 0 | 2 | 9 |\n| Data Service | 1 | 2 | 1 | 3 | 1 | 1 | 9 |\n\n## Findings\n\n### HIGH-001: Insufficient Input Validation\n- **Severity**: High (CVSS 7.5)\n- **Component**: API Gateway\n- **Category**: A03 Injection\n- **Description**: User input not sanitized before database query\n- **Impact**: SQL injection possible, data exfiltration risk\n- **Remediation**: Implement parameterized queries, add input validation\n- **Status**: Open\n\n### HIGH-002: Missing Rate Limiting\n- **Severity**: High (CVSS 7.2)\n- **Component**: API Gateway\n- **Category**: A05 Denial of Service\n- **Description**: No rate limiting on authentication endpoints\n- **Impact**: Brute force attacks, credential stuffing\n- **Remediation**: Implement rate limiting, add account lockout\n- **Status**: Open\n\n### MEDIUM-001: Verbose Error Messages\n...\n\n## Control Assessment\n\n| Control | Requirement | Status | Gap |\n|---------|-------------|--------|-----|\n| Authentication | MFA for privileged users | ✅ Implemented | None |\n| Authorization | RBAC with least privilege | ⚠️ Partial | Admin role too broad |\n| Encryption | TLS 1.2+ for transit | ✅ Implemented | None |\n| Encryption | AES-256 at rest | ⚠️ Partial | Logs not encrypted |\n| Logging | Security event logging | ✅ Implemented | None |\n| Monitoring | Real-time alerting | ❌ Missing | Not configured |\n\n## Compliance Status\n\n| Framework | Status | Gaps |\n|-----------|--------|------|\n| OWASP Top 10 | 7\u002F10 compliant | A03, A05, A09 |\n| SOC 2 | Partial | Monitoring, encryption |\n| GDPR | Compliant | None identified |\n\n## Remediation Roadmap\n\n### Immediate (24-48 hours)\n- [ ] Fix SQL injection vulnerability (HIGH-001)\n- [ ] Implement rate limiting (HIGH-002)\n\n### Short-term (1-2 weeks)\n- [ ] Reduce admin role permissions\n- [ ] Encrypt log storage\n- [ ] Configure monitoring alerts\n\n### Medium-term (1 month)\n- [ ] Address medium-severity findings\n- [ ] Complete SOC 2 gap remediation\n\n## Next Assessment\n\nRecommended: 30 days or after major changes\n```\n\n## Usage Examples\n\n### Full Assessment\n\n```\nUser: \"Run security review\"\n\nSkill orchestrates:\n1. Load current architecture\n2. Run STRIDE analysis\n3. Scan for OWASP patterns\n4. Validate controls\n5. Generate report\n\nOutput:\n\"Security Assessment Complete\n\nFindings: 0 Critical, 2 High, 5 Medium, 8 Low\nRisk Level: MEDIUM\n\nBlocking Issues:\n- HIGH-001: SQL injection risk\n- HIGH-002: Missing rate limiting\n\nReport: .aiwg\u002Fsecurity\u002Fassessment-20251208.md\"\n```\n\n### Component Assessment\n\n```\nUser: \"Threat model the authentication service\"\n\nSkill focuses on:\n- Auth service components only\n- STRIDE for auth flows\n- Auth-specific vulnerabilities\n- Control validation for auth\n\nOutput: Targeted threat model and findings\n```\n\n### Control Validation Only\n\n```\nUser: \"Validate security controls\"\n\nSkill runs:\n- Control mapping\n- Implementation verification\n- Gap analysis\n\nOutput: Control assessment summary\n```\n\n## Integration\n\nThis skill uses:\n- `parallel-dispatch`: Launch security agents concurrently\n- `project-awareness`: Get architecture and component info\n- `artifact-metadata`: Track assessment artifacts\n\n## Agent Orchestration\n\n```yaml\nagents:\n  threat_modeling:\n    agent: security-architect\n    focus: STRIDE analysis, attack vectors, trust boundaries\n\n  vulnerability_scanning:\n    agent: security-auditor\n    focus: OWASP patterns, secrets, dependencies, configuration\n\n  control_validation:\n    agent: security-gatekeeper\n    focus: Control mapping, implementation, effectiveness\n\n  privacy_assessment:\n    agent: privacy-officer\n    focus: PII handling, consent, retention, transfers\n    condition: has_pii == true\n```\n\n## Output Locations\n\n- Assessment report: `.aiwg\u002Fsecurity\u002Fassessment-{date}.md`\n- Threat model: `.aiwg\u002Fsecurity\u002Fthreat-model.md`\n- Control matrix: `.aiwg\u002Fsecurity\u002Fcontrol-matrix.md`\n- Findings tracker: `.aiwg\u002Fsecurity\u002Ffindings\u002F`\n\n## References\n\n- STRIDE methodology: Microsoft Threat Modeling\n- OWASP Top 10: https:\u002F\u002Fowasp.org\u002FTop10\u002F\n- CVSS Calculator: https:\u002F\u002Fwww.first.org\u002Fcvss\u002Fcalculator\u002F3.1\n- Security templates: templates\u002Fsecurity\u002F\n","# security-assessment\n\nExecute threat modeling, vulnerability scanning, and security control validation.\n\n## Triggers\n\n\nAlternate expressions and non-obvious activations (primary phrases are matched automatically from the skill description):\n\n- \"STRIDE [component]\" → threat model using STRIDE framework\n- \"OWASP check\" → OWASP Top 10 validation\n- \"SAST\" \u002F \"DAST\" → static\u002Fdynamic application security testing\n- \"CVE scan\" → known vulnerability enumeration\n- \"is the code safe\" → colloquial security check\n- \"pentest prep\" → pre-penetration-test readiness\n\n## Purpose\n\nThis skill orchestrates comprehensive security assessment through:\n- STRIDE threat modeling\n- Vulnerability pattern detection\n- Security control validation\n- Compliance verification\n- Risk scoring and prioritization\n\n## Behavior\n\nWhen triggered, this skill:\n\n1. **Determines scope**:\n   - Component-level, system-level, or full assessment\n   - Identify assets and trust boundaries\n   - Load existing threat model if available\n\n2. **Executes threat modeling**:\n   - Dispatch Security Architect for STRIDE analysis\n   - Enumerate threats per component\n   - Identify attack vectors\n\n3. **Runs vulnerability patterns**:\n   - Dispatch Security Auditor for pattern scanning\n   - Check OWASP Top 10\n   - Identify secrets exposure risks\n   - Review dependency vulnerabilities\n\n4. **Validates controls**:\n   - Dispatch Security Gatekeeper\n   - Map controls to threats\n   - Verify implementation\n   - Check coverage gaps\n\n5. **Assesses privacy**:\n   - Dispatch Privacy Officer (if PII involved)\n   - Check data handling\n   - Verify consent mechanisms\n\n6. **Generates report**:\n   - Risk-ranked findings\n   - CVSS scores where applicable\n   - Remediation guidance\n   - Compliance status\n\n## STRIDE Threat Categories\n\n| Category | Description | Example |\n|----------|-------------|---------|\n| **S**poofing | Impersonating something\u002Fsomeone | Fake user credentials |\n| **T**ampering | Modifying data or code | SQL injection |\n| **R**epudiation | Denying actions | Missing audit logs |\n| **I**nformation Disclosure | Exposing information | Data leakage |\n| **D**enial of Service | Disrupting availability | Resource exhaustion |\n| **E**levation of Privilege | Gaining unauthorized access | Broken access control |\n\n## Assessment Flow\n\n```\n┌─────────────────────────────────────────────────────────┐\n│ 1. SCOPE IDENTIFICATION                                 │\n│    • Define assessment boundary                         │\n│    • Identify assets (data, services, infrastructure)   │\n│    • Map trust boundaries                               │\n│    • Load existing threat model (if any)                │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 2. THREAT MODELING (Security Architect)                 │\n│    • Data flow analysis                                 │\n│    • STRIDE enumeration per component                   │\n│    • Attack vector identification                       │\n│    • Trust boundary crossing analysis                   │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 3. VULNERABILITY SCANNING (Security Auditor)            │\n│    • OWASP Top 10 pattern check                         │\n│    • Secrets exposure scan                              │\n│    • Dependency vulnerability check                     │\n│    • Configuration review                               │\n│    • Code pattern analysis                              │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 4. CONTROL VALIDATION (Security Gatekeeper)             │\n│    • Map security requirements to controls              │\n│    • Verify control implementation                      │\n│    • Check control effectiveness                        │\n│    • Identify coverage gaps                             │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 5. PRIVACY ASSESSMENT (Privacy Officer) [if PII]        │\n│    • Data inventory review                              │\n│    • Consent mechanism validation                       │\n│    • Data retention compliance                          │\n│    • Cross-border transfer assessment                   │\n└─────────────────────────────────────────────────────────┘\n                          │\n                          ▼\n┌─────────────────────────────────────────────────────────┐\n│ 6. RISK SCORING & REPORTING                             │\n│    • Calculate CVSS scores                              │\n│    • Prioritize by risk (likelihood × impact)           │\n│    • Generate remediation guidance                      │\n│    • Produce assessment report                          │\n└─────────────────────────────────────────────────────────┘\n```\n\n## OWASP Top 10 Checks\n\n| # | Category | Patterns Checked |\n|---|----------|-----------------|\n| A01 | Broken Access Control | RBAC, ABAC, path traversal, CORS |\n| A02 | Cryptographic Failures | Weak algorithms, key management, TLS |\n| A03 | Injection | SQL, NoSQL, LDAP, OS command, XSS |\n| A04 | Insecure Design | Threat modeling gaps, missing controls |\n| A05 | Security Misconfiguration | Defaults, unnecessary features, verbose errors |\n| A06 | Vulnerable Components | Outdated dependencies, known CVEs |\n| A07 | Auth Failures | Password policies, MFA, session management |\n| A08 | Data Integrity Failures | CI\u002FCD security, unsigned updates |\n| A09 | Logging Failures | Missing logs, sensitive data in logs |\n| A10 | SSRF | Internal resource access, URL validation |\n\n## Severity Scoring\n\n### CVSS Base Metrics\n\n```yaml\nseverity_levels:\n  critical:\n    cvss_range: [9.0, 10.0]\n    description: Immediate remediation required\n    sla: 24 hours\n\n  high:\n    cvss_range: [7.0, 8.9]\n    description: Remediation within sprint\n    sla: 7 days\n\n  medium:\n    cvss_range: [4.0, 6.9]\n    description: Plan remediation\n    sla: 30 days\n\n  low:\n    cvss_range: [0.1, 3.9]\n    description: Address as time permits\n    sla: 90 days\n\n  informational:\n    cvss_range: [0.0, 0.0]\n    description: Awareness only\n    sla: none\n```\n\n## Assessment Report Format\n\n```markdown\n# Security Assessment Report\n\n**Date**: 2025-12-08\n**Scope**: Full System Assessment\n**Assessors**: security-architect, security-auditor, security-gatekeeper\n\n## Executive Summary\n\n| Severity | Count |\n|----------|-------|\n| Critical | 0 |\n| High | 2 |\n| Medium | 5 |\n| Low | 8 |\n| Informational | 3 |\n\n**Overall Risk Level**: MEDIUM\n**Recommendation**: Address high-severity findings before production deployment\n\n## Threat Model Summary\n\n### Trust Boundaries\n1. External → API Gateway\n2. API Gateway → Internal Services\n3. Services → Database\n\n### STRIDE Analysis\n\n| Component | S | T | R | I | D | E | Total |\n|-----------|---|---|---|---|---|---|-------|\n| API Gateway | 2 | 1 | 0 | 1 | 1 | 1 | 6 |\n| Auth Service | 3 | 1 | 1 | 2 | 0 | 2 | 9 |\n| Data Service | 1 | 2 | 1 | 3 | 1 | 1 | 9 |\n\n## Findings\n\n### HIGH-001: Insufficient Input Validation\n- **Severity**: High (CVSS 7.5)\n- **Component**: API Gateway\n- **Category**: A03 Injection\n- **Description**: User input not sanitized before database query\n- **Impact**: SQL injection possible, data exfiltration risk\n- **Remediation**: Implement parameterized queries, add input validation\n- **Status**: Open\n\n### HIGH-002: Missing Rate Limiting\n- **Severity**: High (CVSS 7.2)\n- **Component**: API Gateway\n- **Category**: A05 Denial of Service\n- **Description**: No rate limiting on authentication endpoints\n- **Impact**: Brute force attacks, credential stuffing\n- **Remediation**: Implement rate limiting, add account lockout\n- **Status**: Open\n\n### MEDIUM-001: Verbose Error Messages\n...\n\n## Control Assessment\n\n| Control | Requirement | Status | Gap |\n|---------|-------------|--------|-----|\n| Authentication | MFA for privileged users | ✅ Implemented | None |\n| Authorization | RBAC with least privilege | ⚠️ Partial | Admin role too broad |\n| Encryption | TLS 1.2+ for transit | ✅ Implemented | None |\n| Encryption | AES-256 at rest | ⚠️ Partial | Logs not encrypted |\n| Logging | Security event logging | ✅ Implemented | None |\n| Monitoring | Real-time alerting | ❌ Missing | Not configured |\n\n## Compliance Status\n\n| Framework | Status | Gaps |\n|-----------|--------|------|\n| OWASP Top 10 | 7\u002F10 compliant | A03, A05, A09 |\n| SOC 2 | Partial | Monitoring, encryption |\n| GDPR | Compliant | None identified |\n\n## Remediation Roadmap\n\n### Immediate (24-48 hours)\n- [ ] Fix SQL injection vulnerability (HIGH-001)\n- [ ] Implement rate limiting (HIGH-002)\n\n### Short-term (1-2 weeks)\n- [ ] Reduce admin role permissions\n- [ ] Encrypt log storage\n- [ ] Configure monitoring alerts\n\n### Medium-term (1 month)\n- [ ] Address medium-severity findings\n- [ ] Complete SOC 2 gap remediation\n\n## Next Assessment\n\nRecommended: 30 days or after major changes\n```\n\n## Usage Examples\n\n### Full Assessment\n\n```\nUser: \"Run security review\"\n\nSkill orchestrates:\n1. Load current architecture\n2. Run STRIDE analysis\n3. Scan for OWASP patterns\n4. Validate controls\n5. Generate report\n\nOutput:\n\"Security Assessment Complete\n\nFindings: 0 Critical, 2 High, 5 Medium, 8 Low\nRisk Level: MEDIUM\n\nBlocking Issues:\n- HIGH-001: SQL injection risk\n- HIGH-002: Missing rate limiting\n\nReport: .aiwg\u002Fsecurity\u002Fassessment-20251208.md\"\n```\n\n### Component Assessment\n\n```\nUser: \"Threat model the authentication service\"\n\nSkill focuses on:\n- Auth service components only\n- STRIDE for auth flows\n- Auth-specific vulnerabilities\n- Control validation for auth\n\nOutput: Targeted threat model and findings\n```\n\n### Control Validation Only\n\n```\nUser: \"Validate security controls\"\n\nSkill runs:\n- Control mapping\n- Implementation verification\n- Gap analysis\n\nOutput: Control assessment summary\n```\n\n## Integration\n\nThis skill uses:\n- `parallel-dispatch`: Launch security agents concurrently\n- `project-awareness`: Get architecture and component info\n- `artifact-metadata`: Track assessment artifacts\n\n## Agent Orchestration\n\n```yaml\nagents:\n  threat_modeling:\n    agent: security-architect\n    focus: STRIDE analysis, attack vectors, trust boundaries\n\n  vulnerability_scanning:\n    agent: security-auditor\n    focus: OWASP patterns, secrets, dependencies, configuration\n\n  control_validation:\n    agent: security-gatekeeper\n    focus: Control mapping, implementation, effectiveness\n\n  privacy_assessment:\n    agent: privacy-officer\n    focus: PII handling, consent, retention, transfers\n    condition: has_pii == true\n```\n\n## Output Locations\n\n- Assessment report: `.aiwg\u002Fsecurity\u002Fassessment-{date}.md`\n- Threat model: `.aiwg\u002Fsecurity\u002Fthreat-model.md`\n- Control matrix: `.aiwg\u002Fsecurity\u002Fcontrol-matrix.md`\n- Findings tracker: `.aiwg\u002Fsecurity\u002Ffindings\u002F`\n\n## References\n\n- STRIDE methodology: Microsoft Threat Modeling\n- OWASP Top 10: https:\u002F\u002Fowasp.org\u002FTop10\u002F\n- CVSS Calculator: https:\u002F\u002Fwww.first.org\u002Fcvss\u002Fcalculator\u002F3.1\n- Security templates: templates\u002Fsecurity\u002F\n",{"name":5,"triggers":54,"namespace":58,"platforms":59,"description":7},[55,56,57,26],"help with security","help me find the right security review path","start with a scoped security assessment","aiwg",[60],"all","main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fplugins\u002Fcodex-sdlc\u002Fskills\u002Fsecurity-assessment",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-14 10:46:34",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add jmagly\u002Faiwg --skill security-assessment",{"tool":77,"command":78},"bunx","bunx skills add jmagly\u002Faiwg --skill security-assessment",{"tool":80,"command":81},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill security-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fcodex-sdlc\u002Fskills\u002Fsecurity-assessment\u002FSKILL.md",true,[85,91,95],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"manifest.json","REFERENCE","参考文档",49,"https:\u002F\u002Fgithub.com\u002Fmanagedcode\u002Fdotnet-skills\u002Fblob\u002Fmain\u002Fcatalog\u002FFrameworks\u002FWorkflow-Foundation\u002Fskills\u002Fworkflow-foundation\u002Fmanifest.json",{"path":92,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fmigration.md",4458,"https:\u002F\u002Fgithub.com\u002Fmanagedcode\u002Fdotnet-skills\u002Fblob\u002Fmain\u002Fcatalog\u002FFrameworks\u002FWorkflow-Foundation\u002Fskills\u002Fworkflow-foundation\u002Freferences\u002Fmigration.md",{"path":96,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fpatterns.md",7667,"https:\u002F\u002Fgithub.com\u002Fmanagedcode\u002Fdotnet-skills\u002Fblob\u002Fmain\u002Fcatalog\u002FFrameworks\u002FWorkflow-Foundation\u002Fskills\u002Fworkflow-foundation\u002Freferences\u002Fpatterns.md",[100,128,152,158,165,179],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":107,"publishedAt":49},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[106],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127],"host","host hardening","hardening","read","re","recommendations","remediation","plan","port","verification","Bash","access","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":138,"publishedAt":49},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[134,137],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,140,141,111,142,116,143,144,118,145,108,146,120,147,148,123,124,149,150,151],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator","write",{"skillNo":153,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":49},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[110,108,109,119,111,127,114,113,122,115,116,117,118,126,120,121,112,123,124,125],{"skillNo":159,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":164,"publishedAt":49},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[162,163],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[140,139,123,142,116,143,118,141,108,146,120,147,148,111,124,145,144,149,150,151],{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":49},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[171],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[173,174,175,176,177,178],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":49},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[185],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[187,188,147,189,174],"pi","pi local","duplicate"]