[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D7BQ1285DH2F673B4GJARD":3,"skill-same:01M6D7BQ1285DH2F673B4GJARD":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M6D7BQ1285DH2F673B4GJARD","senior-security",null,"Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools.","oabdelmaksoud\u002FSuperClaw","oabdelmaksoud","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F50699149?v=4","01M6D5CVVN778ZCDP1WHS816SP","Omar Abdelmaksoud","01M6D5CW1RHNSKCJR85GJACBFT",2,"MIT","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fclaude-skills\u002Fengineering-team\u002Fsenior-security\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","senior security","vulnerability assessment","testing","modeling","patterns","zero trust","scanning","vulnerability","security audit","Security Scanning Tools","analysis","cryptography","owasp","audit","assessment","secure","architecture","threat modeling","application security","2026-11-10 10:12:30",false,"---\nname: senior-security\ndescription: Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools.\ntriggers:\n  - security architecture\n  - threat modeling\n  - STRIDE analysis\n  - penetration testing\n  - vulnerability assessment\n  - secure coding\n  - OWASP\n  - application security\n  - cryptography implementation\n  - secret scanning\n  - security audit\n  - zero trust\n---\n\n# Senior Security Engineer\n\nSecurity engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.\n\n---\n\n## Table of Contents\n\n- [Threat Modeling Workflow](#threat-modeling-workflow)\n- [Security Architecture Workflow](#security-architecture-workflow)\n- [Vulnerability Assessment Workflow](#vulnerability-assessment-workflow)\n- [Secure Code Review Workflow](#secure-code-review-workflow)\n- [Incident Response Workflow](#incident-response-workflow)\n- [Security Tools Reference](#security-tools-reference)\n- [Tools and References](#tools-and-references)\n\n---\n\n## Threat Modeling Workflow\n\nIdentify and analyze security threats using STRIDE methodology.\n\n### Workflow: Conduct Threat Model\n\n1. Define system scope and boundaries:\n   - Identify assets to protect\n   - Map trust boundaries\n   - Document data flows\n2. Create data flow diagram:\n   - External entities (users, services)\n   - Processes (application components)\n   - Data stores (databases, caches)\n   - Data flows (APIs, network connections)\n3. Apply STRIDE to each DFD element:\n   - Spoofing: Can identity be faked?\n   - Tampering: Can data be modified?\n   - Repudiation: Can actions be denied?\n   - Information Disclosure: Can data leak?\n   - Denial of Service: Can availability be affected?\n   - Elevation of Privilege: Can access be escalated?\n4. Score risks using DREAD:\n   - Damage potential (1-10)\n   - Reproducibility (1-10)\n   - Exploitability (1-10)\n   - Affected users (1-10)\n   - Discoverability (1-10)\n5. Prioritize threats by risk score\n6. Define mitigations for each threat\n7. Document in threat model report\n8. **Validation:** All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped\n\n### STRIDE Threat Categories\n\n| Category | Description | Security Property | Mitigation Focus |\n|----------|-------------|-------------------|------------------|\n| Spoofing | Impersonating users or systems | Authentication | MFA, certificates, strong auth |\n| Tampering | Modifying data or code | Integrity | Signing, checksums, validation |\n| Repudiation | Denying actions | Non-repudiation | Audit logs, digital signatures |\n| Information Disclosure | Exposing data | Confidentiality | Encryption, access controls |\n| Denial of Service | Disrupting availability | Availability | Rate limiting, redundancy |\n| Elevation of Privilege | Gaining unauthorized access | Authorization | RBAC, least privilege |\n\n### STRIDE per Element Matrix\n\n| DFD Element | S | T | R | I | D | E |\n|-------------|---|---|---|---|---|---|\n| External Entity | X | | X | | | |\n| Process | X | X | X | X | X | X |\n| Data Store | | X | X | X | X | |\n| Data Flow | | X | | X | X | |\n\nSee: [references\u002Fthreat-modeling-guide.md](references\u002Fthreat-modeling-guide.md)\n\n---\n\n## Security Architecture Workflow\n\nDesign secure systems using defense-in-depth principles.\n\n### Workflow: Design Secure Architecture\n\n1. Define security requirements:\n   - Compliance requirements (GDPR, HIPAA, PCI-DSS)\n   - Data classification (public, internal, confidential, restricted)\n   - Threat model inputs\n2. Apply defense-in-depth layers:\n   - Perimeter: WAF, DDoS protection, rate limiting\n   - Network: Segmentation, IDS\u002FIPS, mTLS\n   - Host: Patching, EDR, hardening\n   - Application: Input validation, authentication, secure coding\n   - Data: Encryption at rest and in transit\n3. Implement Zero Trust principles:\n   - Verify explicitly (every request)\n   - Least privilege access (JIT\u002FJEA)\n   - Assume breach (segment, monitor)\n4. Configure authentication and authorization:\n   - Identity provider selection\n   - MFA requirements\n   - RBAC\u002FABAC model\n5. Design encryption strategy:\n   - Key management approach\n   - Algorithm selection\n   - Certificate lifecycle\n6. Plan security monitoring:\n   - Log aggregation\n   - SIEM integration\n   - Alerting rules\n7. Document architecture decisions\n8. **Validation:** Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned\n\n### Defense-in-Depth Layers\n\n```\nLayer 1: PERIMETER\n  WAF, DDoS mitigation, DNS filtering, rate limiting\n\nLayer 2: NETWORK\n  Segmentation, IDS\u002FIPS, network monitoring, VPN, mTLS\n\nLayer 3: HOST\n  Endpoint protection, OS hardening, patching, logging\n\nLayer 4: APPLICATION\n  Input validation, authentication, secure coding, SAST\n\nLayer 5: DATA\n  Encryption at rest\u002Ftransit, access controls, DLP, backup\n```\n\n### Authentication Pattern Selection\n\n| Use Case | Recommended Pattern |\n|----------|---------------------|\n| Web application | OAuth 2.0 + PKCE with OIDC |\n| API authentication | JWT with short expiration + refresh tokens |\n| Service-to-service | mTLS with certificate rotation |\n| CLI\u002FAutomation | API keys with IP allowlisting |\n| High security | FIDO2\u002FWebAuthn hardware keys |\n\nSee: [references\u002Fsecurity-architecture-patterns.md](references\u002Fsecurity-architecture-patterns.md)\n\n---\n\n## Vulnerability Assessment Workflow\n\nIdentify and remediate security vulnerabilities in applications.\n\n### Workflow: Conduct Vulnerability Assessment\n\n1. Define assessment scope:\n   - In-scope systems and applications\n   - Testing methodology (black box, gray box, white box)\n   - Rules of engagement\n2. Gather information:\n   - Technology stack inventory\n   - Architecture documentation\n   - Previous vulnerability reports\n3. Perform automated scanning:\n   - SAST (static analysis)\n   - DAST (dynamic analysis)\n   - Dependency scanning\n   - Secret detection\n4. Conduct manual testing:\n   - Business logic flaws\n   - Authentication bypass\n   - Authorization issues\n   - Injection vulnerabilities\n5. Classify findings by severity:\n   - Critical: Immediate exploitation risk\n   - High: Significant impact, easier to exploit\n   - Medium: Moderate impact or difficulty\n   - Low: Minor impact\n6. Develop remediation plan:\n   - Prioritize by risk\n   - Assign owners\n   - Set deadlines\n7. Verify fixes and document\n8. **Validation:** Scope defined; automated and manual testing complete; findings classified; remediation tracked\n\n### OWASP Top 10 Mapping\n\n| Rank | Vulnerability | Testing Approach |\n|------|---------------|------------------|\n| A01 | Broken Access Control | Manual IDOR testing, authorization checks |\n| A02 | Cryptographic Failures | Algorithm review, key management audit |\n| A03 | Injection | SAST + manual payload testing |\n| A04 | Insecure Design | Threat modeling, architecture review |\n| A05 | Security Misconfiguration | Configuration audit, CIS benchmarks |\n| A06 | Vulnerable Components | Dependency scanning, CVE monitoring |\n| A07 | Authentication Failures | Password policy, session management review |\n| A08 | Software\u002FData Integrity | CI\u002FCD security, code signing verification |\n| A09 | Logging Failures | Log review, SIEM configuration check |\n| A10 | SSRF | Manual URL manipulation testing |\n\n### Vulnerability Severity Matrix\n\n| Impact \u002F Exploitability | Easy | Moderate | Difficult |\n|-------------------------|------|----------|-----------|\n| Critical | Critical | Critical | High |\n| High | Critical | High | Medium |\n| Medium | High | Medium | Low |\n| Low | Medium | Low | Low |\n\n---\n\n## Secure Code Review Workflow\n\nReview code for security vulnerabilities before deployment.\n\n### Workflow: Conduct Security Code Review\n\n1. Establish review scope:\n   - Changed files and functions\n   - Security-sensitive areas (auth, crypto, input handling)\n   - Third-party integrations\n2. Run automated analysis:\n   - SAST tools (Semgrep, CodeQL, Bandit)\n   - Secret scanning\n   - Dependency vulnerability check\n3. Review authentication code:\n   - Password handling (hashing, storage)\n   - Session management\n   - Token validation\n4. Review authorization code:\n   - Access control checks\n   - RBAC implementation\n   - Privilege boundaries\n5. Review data handling:\n   - Input validation\n   - Output encoding\n   - SQL query construction\n   - File path handling\n6. Review cryptographic code:\n   - Algorithm selection\n   - Key management\n   - Random number generation\n7. Document findings with severity\n8. **Validation:** Automated scans passed; auth\u002Fauthz reviewed; data handling checked; crypto verified; findings documented\n\n### Security Code Review Checklist\n\n| Category | Check | Risk |\n|----------|-------|------|\n| Input Validation | All user input validated and sanitized | Injection |\n| Output Encoding | Context-appropriate encoding applied | XSS |\n| Authentication | Passwords hashed with Argon2\u002Fbcrypt | Credential theft |\n| Session | Secure cookie flags set (HttpOnly, Secure, SameSite) | Session hijacking |\n| Authorization | Server-side permission checks on all endpoints | Privilege escalation |\n| SQL | Parameterized queries used exclusively | SQL injection |\n| File Access | Path traversal sequences rejected | Path traversal |\n| Secrets | No hardcoded credentials or keys | Information disclosure |\n| Dependencies | Known vulnerable packages updated | Supply chain |\n| Logging | Sensitive data not logged | Information disclosure |\n\n### Secure vs Insecure Patterns\n\n| Pattern | Issue | Secure Alternative |\n|---------|-------|-------------------|\n| SQL string formatting | SQL injection | Use parameterized queries with placeholders |\n| Shell command building | Command injection | Use subprocess with argument lists, no shell |\n| Path concatenation | Path traversal | Validate and canonicalize paths |\n| MD5\u002FSHA1 for passwords | Weak hashing | Use Argon2id or bcrypt |\n| Math.random for tokens | Predictable values | Use crypto.getRandomValues |\n\n---\n\n## Incident Response Workflow\n\nRespond to and contain security incidents.\n\n### Workflow: Handle Security Incident\n\n1. Identify and triage:\n   - Validate incident is genuine\n   - Assess initial scope and severity\n   - Activate incident response team\n2. Contain the threat:\n   - Isolate affected systems\n   - Block malicious IPs\u002Faccounts\n   - Disable compromised credentials\n3. Eradicate root cause:\n   - Remove malware\u002Fbackdoors\n   - Patch vulnerabilities\n   - Update configurations\n4. Recover operations:\n   - Restore from clean backups\n   - Verify system integrity\n   - Monitor for recurrence\n5. Conduct post-mortem:\n   - Timeline reconstruction\n   - Root cause analysis\n   - Lessons learned\n6. Implement improvements:\n   - Update detection rules\n   - Enhance controls\n   - Update runbooks\n7. Document and report\n8. **Validation:** Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented\n\n### Incident Severity Levels\n\n| Level | Description | Response Time | Escalation |\n|-------|-------------|---------------|------------|\n| P1 - Critical | Active breach, data exfiltration | Immediate | CISO, Legal, Executive |\n| P2 - High | Confirmed compromise, contained | 1 hour | Security Lead, IT Director |\n| P3 - Medium | Potential compromise, under investigation | 4 hours | Security Team |\n| P4 - Low | Suspicious activity, low impact | 24 hours | On-call engineer |\n\n### Incident Response Checklist\n\n| Phase | Actions |\n|-------|---------|\n| Identification | Validate alert, assess scope, determine severity |\n| Containment | Isolate systems, preserve evidence, block access |\n| Eradication | Remove threat, patch vulnerabilities, reset credentials |\n| Recovery | Restore services, verify integrity, increase monitoring |\n| Lessons Learned | Document timeline, identify gaps, update procedures |\n\n---\n\n## Security Tools Reference\n\n### Recommended Security Tools\n\n| Category | Tools |\n|----------|-------|\n| SAST | Semgrep, CodeQL, Bandit (Python), ESLint security plugins |\n| DAST | OWASP ZAP, Burp Suite, Nikto |\n| Dependency Scanning | Snyk, Dependabot, npm audit, pip-audit |\n| Secret Detection | GitLeaks, TruffleHog, detect-secrets |\n| Container Security | Trivy, Clair, Anchore |\n| Infrastructure | Checkov, tfsec, ScoutSuite |\n| Network | Wireshark, Nmap, Masscan |\n| Penetration | Metasploit, sqlmap, Burp Suite Pro |\n\n### Cryptographic Algorithm Selection\n\n| Use Case | Algorithm | Key Size |\n|----------|-----------|----------|\n| Symmetric encryption | AES-256-GCM | 256 bits |\n| Password hashing | Argon2id | N\u002FA (use defaults) |\n| Message authentication | HMAC-SHA256 | 256 bits |\n| Digital signatures | Ed25519 | 256 bits |\n| Key exchange | X25519 | 256 bits |\n| TLS | TLS 1.3 | N\u002FA |\n\nSee: [references\u002Fcryptography-implementation.md](references\u002Fcryptography-implementation.md)\n\n---\n\n## Tools and References\n\n### Scripts\n\n| Script | Purpose | Usage |\n|--------|---------|-------|\n| [threat_modeler.py](scripts\u002Fthreat_modeler.py) | STRIDE threat analysis with risk scoring | `python threat_modeler.py --component \"Authentication\"` |\n| [secret_scanner.py](scripts\u002Fsecret_scanner.py) | Detect hardcoded secrets and credentials | `python secret_scanner.py \u002Fpath\u002Fto\u002Fproject` |\n\n**Threat Modeler Features:**\n- STRIDE analysis for any system component\n- DREAD risk scoring\n- Mitigation recommendations\n- JSON and text output formats\n- Interactive mode for guided analysis\n\n**Secret Scanner Features:**\n- Detects AWS, GCP, Azure credentials\n- Finds API keys and tokens (GitHub, Slack, Stripe)\n- Identifies private keys and passwords\n- Supports 20+ secret patterns\n- CI\u002FCD integration ready\n\n### References\n\n| Document | Content |\n|----------|---------|\n| [security-architecture-patterns.md](references\u002Fsecurity-architecture-patterns.md) | Zero Trust, defense-in-depth, authentication patterns, API security |\n| [threat-modeling-guide.md](references\u002Fthreat-modeling-guide.md) | STRIDE methodology, attack trees, DREAD scoring, DFD creation |\n| [cryptography-implementation.md](references\u002Fcryptography-implementation.md) | AES-GCM, RSA, Ed25519, password hashing, key management |\n\n---\n\n## Security Standards Reference\n\n### Compliance Frameworks\n\n| Framework | Focus | Applicable To |\n|-----------|-------|---------------|\n| OWASP ASVS | Application security | Web applications |\n| CIS Benchmarks | System hardening | Servers, containers, cloud |\n| NIST CSF | Risk management | Enterprise security programs |\n| PCI-DSS | Payment card data | Payment processing |\n| HIPAA | Healthcare data | Healthcare applications |\n| SOC 2 | Service organization controls | SaaS providers |\n\n### Security Headers Checklist\n\n| Header | Recommended Value |\n|--------|-------------------|\n| Content-Security-Policy | default-src self; script-src self |\n| X-Frame-Options | DENY |\n| X-Content-Type-Options | nosniff |\n| Strict-Transport-Security | max-age=31536000; includeSubDomains |\n| Referrer-Policy | strict-origin-when-cross-origin |\n| Permissions-Policy | geolocation=(), microphone=(), camera=() |\n\n---\n\n## Related Skills\n\n| Skill | Integration Point |\n|-------|-------------------|\n| [senior-devops](..\u002Fsenior-devops\u002F) | CI\u002FCD security, infrastructure hardening |\n| [senior-secops](..\u002Fsenior-secops\u002F) | Security monitoring, incident response |\n| [senior-backend](..\u002Fsenior-backend\u002F) | Secure API development |\n| [senior-architect](..\u002Fsenior-architect\u002F) | Security architecture decisions |\n","# Senior Security Engineer\n\nSecurity engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.\n\n---\n\n## Table of Contents\n\n- [Threat Modeling Workflow](#threat-modeling-workflow)\n- [Security Architecture Workflow](#security-architecture-workflow)\n- [Vulnerability Assessment Workflow](#vulnerability-assessment-workflow)\n- [Secure Code Review Workflow](#secure-code-review-workflow)\n- [Incident Response Workflow](#incident-response-workflow)\n- [Security Tools Reference](#security-tools-reference)\n- [Tools and References](#tools-and-references)\n\n---\n\n## Threat Modeling Workflow\n\nIdentify and analyze security threats using STRIDE methodology.\n\n### Workflow: Conduct Threat Model\n\n1. Define system scope and boundaries:\n   - Identify assets to protect\n   - Map trust boundaries\n   - Document data flows\n2. Create data flow diagram:\n   - External entities (users, services)\n   - Processes (application components)\n   - Data stores (databases, caches)\n   - Data flows (APIs, network connections)\n3. Apply STRIDE to each DFD element:\n   - Spoofing: Can identity be faked?\n   - Tampering: Can data be modified?\n   - Repudiation: Can actions be denied?\n   - Information Disclosure: Can data leak?\n   - Denial of Service: Can availability be affected?\n   - Elevation of Privilege: Can access be escalated?\n4. Score risks using DREAD:\n   - Damage potential (1-10)\n   - Reproducibility (1-10)\n   - Exploitability (1-10)\n   - Affected users (1-10)\n   - Discoverability (1-10)\n5. Prioritize threats by risk score\n6. Define mitigations for each threat\n7. Document in threat model report\n8. **Validation:** All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped\n\n### STRIDE Threat Categories\n\n| Category | Description | Security Property | Mitigation Focus |\n|----------|-------------|-------------------|------------------|\n| Spoofing | Impersonating users or systems | Authentication | MFA, certificates, strong auth |\n| Tampering | Modifying data or code | Integrity | Signing, checksums, validation |\n| Repudiation | Denying actions | Non-repudiation | Audit logs, digital signatures |\n| Information Disclosure | Exposing data | Confidentiality | Encryption, access controls |\n| Denial of Service | Disrupting availability | Availability | Rate limiting, redundancy |\n| Elevation of Privilege | Gaining unauthorized access | Authorization | RBAC, least privilege |\n\n### STRIDE per Element Matrix\n\n| DFD Element | S | T | R | I | D | E |\n|-------------|---|---|---|---|---|---|\n| External Entity | X | | X | | | |\n| Process | X | X | X | X | X | X |\n| Data Store | | X | X | X | X | |\n| Data Flow | | X | | X | X | |\n\nSee: [references\u002Fthreat-modeling-guide.md](references\u002Fthreat-modeling-guide.md)\n\n---\n\n## Security Architecture Workflow\n\nDesign secure systems using defense-in-depth principles.\n\n### Workflow: Design Secure Architecture\n\n1. Define security requirements:\n   - Compliance requirements (GDPR, HIPAA, PCI-DSS)\n   - Data classification (public, internal, confidential, restricted)\n   - Threat model inputs\n2. Apply defense-in-depth layers:\n   - Perimeter: WAF, DDoS protection, rate limiting\n   - Network: Segmentation, IDS\u002FIPS, mTLS\n   - Host: Patching, EDR, hardening\n   - Application: Input validation, authentication, secure coding\n   - Data: Encryption at rest and in transit\n3. Implement Zero Trust principles:\n   - Verify explicitly (every request)\n   - Least privilege access (JIT\u002FJEA)\n   - Assume breach (segment, monitor)\n4. Configure authentication and authorization:\n   - Identity provider selection\n   - MFA requirements\n   - RBAC\u002FABAC model\n5. Design encryption strategy:\n   - Key management approach\n   - Algorithm selection\n   - Certificate lifecycle\n6. Plan security monitoring:\n   - Log aggregation\n   - SIEM integration\n   - Alerting rules\n7. Document architecture decisions\n8. **Validation:** Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned\n\n### Defense-in-Depth Layers\n\n```\nLayer 1: PERIMETER\n  WAF, DDoS mitigation, DNS filtering, rate limiting\n\nLayer 2: NETWORK\n  Segmentation, IDS\u002FIPS, network monitoring, VPN, mTLS\n\nLayer 3: HOST\n  Endpoint protection, OS hardening, patching, logging\n\nLayer 4: APPLICATION\n  Input validation, authentication, secure coding, SAST\n\nLayer 5: DATA\n  Encryption at rest\u002Ftransit, access controls, DLP, backup\n```\n\n### Authentication Pattern Selection\n\n| Use Case | Recommended Pattern |\n|----------|---------------------|\n| Web application | OAuth 2.0 + PKCE with OIDC |\n| API authentication | JWT with short expiration + refresh tokens |\n| Service-to-service | mTLS with certificate rotation |\n| CLI\u002FAutomation | API keys with IP allowlisting |\n| High security | FIDO2\u002FWebAuthn hardware keys |\n\nSee: [references\u002Fsecurity-architecture-patterns.md](references\u002Fsecurity-architecture-patterns.md)\n\n---\n\n## Vulnerability Assessment Workflow\n\nIdentify and remediate security vulnerabilities in applications.\n\n### Workflow: Conduct Vulnerability Assessment\n\n1. Define assessment scope:\n   - In-scope systems and applications\n   - Testing methodology (black box, gray box, white box)\n   - Rules of engagement\n2. Gather information:\n   - Technology stack inventory\n   - Architecture documentation\n   - Previous vulnerability reports\n3. Perform automated scanning:\n   - SAST (static analysis)\n   - DAST (dynamic analysis)\n   - Dependency scanning\n   - Secret detection\n4. Conduct manual testing:\n   - Business logic flaws\n   - Authentication bypass\n   - Authorization issues\n   - Injection vulnerabilities\n5. Classify findings by severity:\n   - Critical: Immediate exploitation risk\n   - High: Significant impact, easier to exploit\n   - Medium: Moderate impact or difficulty\n   - Low: Minor impact\n6. Develop remediation plan:\n   - Prioritize by risk\n   - Assign owners\n   - Set deadlines\n7. Verify fixes and document\n8. **Validation:** Scope defined; automated and manual testing complete; findings classified; remediation tracked\n\n### OWASP Top 10 Mapping\n\n| Rank | Vulnerability | Testing Approach |\n|------|---------------|------------------|\n| A01 | Broken Access Control | Manual IDOR testing, authorization checks |\n| A02 | Cryptographic Failures | Algorithm review, key management audit |\n| A03 | Injection | SAST + manual payload testing |\n| A04 | Insecure Design | Threat modeling, architecture review |\n| A05 | Security Misconfiguration | Configuration audit, CIS benchmarks |\n| A06 | Vulnerable Components | Dependency scanning, CVE monitoring |\n| A07 | Authentication Failures | Password policy, session management review |\n| A08 | Software\u002FData Integrity | CI\u002FCD security, code signing verification |\n| A09 | Logging Failures | Log review, SIEM configuration check |\n| A10 | SSRF | Manual URL manipulation testing |\n\n### Vulnerability Severity Matrix\n\n| Impact \u002F Exploitability | Easy | Moderate | Difficult |\n|-------------------------|------|----------|-----------|\n| Critical | Critical | Critical | High |\n| High | Critical | High | Medium |\n| Medium | High | Medium | Low |\n| Low | Medium | Low | Low |\n\n---\n\n## Secure Code Review Workflow\n\nReview code for security vulnerabilities before deployment.\n\n### Workflow: Conduct Security Code Review\n\n1. Establish review scope:\n   - Changed files and functions\n   - Security-sensitive areas (auth, crypto, input handling)\n   - Third-party integrations\n2. Run automated analysis:\n   - SAST tools (Semgrep, CodeQL, Bandit)\n   - Secret scanning\n   - Dependency vulnerability check\n3. Review authentication code:\n   - Password handling (hashing, storage)\n   - Session management\n   - Token validation\n4. Review authorization code:\n   - Access control checks\n   - RBAC implementation\n   - Privilege boundaries\n5. Review data handling:\n   - Input validation\n   - Output encoding\n   - SQL query construction\n   - File path handling\n6. Review cryptographic code:\n   - Algorithm selection\n   - Key management\n   - Random number generation\n7. Document findings with severity\n8. **Validation:** Automated scans passed; auth\u002Fauthz reviewed; data handling checked; crypto verified; findings documented\n\n### Security Code Review Checklist\n\n| Category | Check | Risk |\n|----------|-------|------|\n| Input Validation | All user input validated and sanitized | Injection |\n| Output Encoding | Context-appropriate encoding applied | XSS |\n| Authentication | Passwords hashed with Argon2\u002Fbcrypt | Credential theft |\n| Session | Secure cookie flags set (HttpOnly, Secure, SameSite) | Session hijacking |\n| Authorization | Server-side permission checks on all endpoints | Privilege escalation |\n| SQL | Parameterized queries used exclusively | SQL injection |\n| File Access | Path traversal sequences rejected | Path traversal |\n| Secrets | No hardcoded credentials or keys | Information disclosure |\n| Dependencies | Known vulnerable packages updated | Supply chain |\n| Logging | Sensitive data not logged | Information disclosure |\n\n### Secure vs Insecure Patterns\n\n| Pattern | Issue | Secure Alternative |\n|---------|-------|-------------------|\n| SQL string formatting | SQL injection | Use parameterized queries with placeholders |\n| Shell command building | Command injection | Use subprocess with argument lists, no shell |\n| Path concatenation | Path traversal | Validate and canonicalize paths |\n| MD5\u002FSHA1 for passwords | Weak hashing | Use Argon2id or bcrypt |\n| Math.random for tokens | Predictable values | Use crypto.getRandomValues |\n\n---\n\n## Incident Response Workflow\n\nRespond to and contain security incidents.\n\n### Workflow: Handle Security Incident\n\n1. Identify and triage:\n   - Validate incident is genuine\n   - Assess initial scope and severity\n   - Activate incident response team\n2. Contain the threat:\n   - Isolate affected systems\n   - Block malicious IPs\u002Faccounts\n   - Disable compromised credentials\n3. Eradicate root cause:\n   - Remove malware\u002Fbackdoors\n   - Patch vulnerabilities\n   - Update configurations\n4. Recover operations:\n   - Restore from clean backups\n   - Verify system integrity\n   - Monitor for recurrence\n5. Conduct post-mortem:\n   - Timeline reconstruction\n   - Root cause analysis\n   - Lessons learned\n6. Implement improvements:\n   - Update detection rules\n   - Enhance controls\n   - Update runbooks\n7. Document and report\n8. **Validation:** Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented\n\n### Incident Severity Levels\n\n| Level | Description | Response Time | Escalation |\n|-------|-------------|---------------|------------|\n| P1 - Critical | Active breach, data exfiltration | Immediate | CISO, Legal, Executive |\n| P2 - High | Confirmed compromise, contained | 1 hour | Security Lead, IT Director |\n| P3 - Medium | Potential compromise, under investigation | 4 hours | Security Team |\n| P4 - Low | Suspicious activity, low impact | 24 hours | On-call engineer |\n\n### Incident Response Checklist\n\n| Phase | Actions |\n|-------|---------|\n| Identification | Validate alert, assess scope, determine severity |\n| Containment | Isolate systems, preserve evidence, block access |\n| Eradication | Remove threat, patch vulnerabilities, reset credentials |\n| Recovery | Restore services, verify integrity, increase monitoring |\n| Lessons Learned | Document timeline, identify gaps, update procedures |\n\n---\n\n## Security Tools Reference\n\n### Recommended Security Tools\n\n| Category | Tools |\n|----------|-------|\n| SAST | Semgrep, CodeQL, Bandit (Python), ESLint security plugins |\n| DAST | OWASP ZAP, Burp Suite, Nikto |\n| Dependency Scanning | Snyk, Dependabot, npm audit, pip-audit |\n| Secret Detection | GitLeaks, TruffleHog, detect-secrets |\n| Container Security | Trivy, Clair, Anchore |\n| Infrastructure | Checkov, tfsec, ScoutSuite |\n| Network | Wireshark, Nmap, Masscan |\n| Penetration | Metasploit, sqlmap, Burp Suite Pro |\n\n### Cryptographic Algorithm Selection\n\n| Use Case | Algorithm | Key Size |\n|----------|-----------|----------|\n| Symmetric encryption | AES-256-GCM | 256 bits |\n| Password hashing | Argon2id | N\u002FA (use defaults) |\n| Message authentication | HMAC-SHA256 | 256 bits |\n| Digital signatures | Ed25519 | 256 bits |\n| Key exchange | X25519 | 256 bits |\n| TLS | TLS 1.3 | N\u002FA |\n\nSee: [references\u002Fcryptography-implementation.md](references\u002Fcryptography-implementation.md)\n\n---\n\n## Tools and References\n\n### Scripts\n\n| Script | Purpose | Usage |\n|--------|---------|-------|\n| [threat_modeler.py](scripts\u002Fthreat_modeler.py) | STRIDE threat analysis with risk scoring | `python threat_modeler.py --component \"Authentication\"` |\n| [secret_scanner.py](scripts\u002Fsecret_scanner.py) | Detect hardcoded secrets and credentials | `python secret_scanner.py \u002Fpath\u002Fto\u002Fproject` |\n\n**Threat Modeler Features:**\n- STRIDE analysis for any system component\n- DREAD risk scoring\n- Mitigation recommendations\n- JSON and text output formats\n- Interactive mode for guided analysis\n\n**Secret Scanner Features:**\n- Detects AWS, GCP, Azure credentials\n- Finds API keys and tokens (GitHub, Slack, Stripe)\n- Identifies private keys and passwords\n- Supports 20+ secret patterns\n- CI\u002FCD integration ready\n\n### References\n\n| Document | Content |\n|----------|---------|\n| [security-architecture-patterns.md](references\u002Fsecurity-architecture-patterns.md) | Zero Trust, defense-in-depth, authentication patterns, API security |\n| [threat-modeling-guide.md](references\u002Fthreat-modeling-guide.md) | STRIDE methodology, attack trees, DREAD scoring, DFD creation |\n| [cryptography-implementation.md](references\u002Fcryptography-implementation.md) | AES-GCM, RSA, Ed25519, password hashing, key management |\n\n---\n\n## Security Standards Reference\n\n### Compliance Frameworks\n\n| Framework | Focus | Applicable To |\n|-----------|-------|---------------|\n| OWASP ASVS | Application security | Web applications |\n| CIS Benchmarks | System hardening | Servers, containers, cloud |\n| NIST CSF | Risk management | Enterprise security programs |\n| PCI-DSS | Payment card data | Payment processing |\n| HIPAA | Healthcare data | Healthcare applications |\n| SOC 2 | Service organization controls | SaaS providers |\n\n### Security Headers Checklist\n\n| Header | Recommended Value |\n|--------|-------------------|\n| Content-Security-Policy | default-src self; script-src self |\n| X-Frame-Options | DENY |\n| X-Content-Type-Options | nosniff |\n| Strict-Transport-Security | max-age=31536000; includeSubDomains |\n| Referrer-Policy | strict-origin-when-cross-origin |\n| Permissions-Policy | geolocation=(), microphone=(), camera=() |\n\n---\n\n## Related Skills\n\n| Skill | Integration Point |\n|-------|-------------------|\n| [senior-devops](..\u002Fsenior-devops\u002F) | CI\u002FCD security, infrastructure hardening |\n| [senior-secops](..\u002Fsenior-secops\u002F) | Security monitoring, incident response |\n| [senior-backend](..\u002Fsenior-backend\u002F) | Secure API development |\n| [senior-architect](..\u002Fsenior-architect\u002F) | Security architecture decisions |\n",{"name":5,"triggers":49,"description":7},[50,42,51,52,26,53,54,43,55,56,33,30],"security architecture","STRIDE analysis","penetration testing","secure coding","OWASP","cryptography implementation","secret scanning","main","7b610356e36623652299fa2acb477ff821b1d920","upstream-sync\u002Fwork\u002Fclaude-skills\u002Fengineering-team\u002Fsenior-security",0,"https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fo-abdelmaksoud\u002F","Full-Stack Engineer | AI Systems Architect | Building autonomous multi-agent systems","2026-03-08 21:12:53",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add oabdelmaksoud\u002FSuperClaw --skill senior-security",{"tool":72,"command":73},"bunx","bunx skills add oabdelmaksoud\u002FSuperClaw --skill senior-security",{"tool":75,"command":76},"pnpm","pnpm dlx skills add oabdelmaksoud\u002FSuperClaw --skill senior-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fclaude-skills\u002Fengineering-team\u002Fsenior-security\u002FSKILL.md",true,[80,86,90,94,100],{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fcryptography-implementation.md","REFERENCE","参考文档",21912,"https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fclaude-skills\u002Fengineering-team\u002Fsenior-security\u002Freferences\u002Fcryptography-implementation.md",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fsecurity-architecture-patterns.md",22198,"https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fclaude-skills\u002Fengineering-team\u002Fsenior-security\u002Freferences\u002Fsecurity-architecture-patterns.md",{"path":91,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fthreat-modeling-guide.md",22659,"https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fclaude-skills\u002Fengineering-team\u002Fsenior-security\u002Freferences\u002Fthreat-modeling-guide.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fsecret_scanner.py","SCRIPT","脚本",18120,"https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fclaude-skills\u002Fengineering-team\u002Fsenior-security\u002Fscripts\u002Fsecret_scanner.py",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fthreat_modeler.py",21325,"https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fclaude-skills\u002Fengineering-team\u002Fsenior-security\u002Fscripts\u002Fthreat_modeler.py",[105,124,138,167,191,209],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":114,"publishedAt":44},"01M6D88QCPTBZVCRED0NZ1Y8K8","visa-doc-translate","Translate visa application documents (images) to English and create a bilingual PDF with original and translation","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fvisa-doc-translate\u002FSKILL.md",[111],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",[115,116,117,118,119,120,121,122,123],"translate","doc","visa doc translate","translation","application","create","images","PDF","documents",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":44},"01M6D88NBM95T3TFM50CYYAP65","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fverification-loop\u002FSKILL.md",[],[131,132,133,134,135,136,137],"verification","loop","verification loop","sessions","code","claude code sessions","system",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":153,"publishedAt":44},"01M6D88JFZ2P996GVRHJNSZSTM","tdd-workflow","Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Ftdd-workflow\u002FSKILL.md",[144,145,148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":146,"categoryName":147,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":149,"categoryName":150,"taxonomyType":151,"taxonomyTypeDesc":152},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[154,155,156,157,158,159,135,160,161,162,163,164,165,166],"tdd","workflow","tdd workflow","e2e tests","e2e","integration","development","use","test","refactoring","coverage","tests","writing",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":44},"01M6D88FTHRRSVJMXF2G7MQAK3","swiftui-patterns","SwiftUI architecture patterns, state management with @Observable, view composition, navigation, performance optimization, and modern iOS\u002FmacOS UI best practices.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fswiftui-patterns\u002FSKILL.md",[],[29,174,175,41,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190],"swiftui","swiftui patterns","macos","performance","state management","best practices","state","ui","Optimization","ios","architecture patterns","Composition","performance optimization","view","management","swiftui architecture","navigation",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":44},"01M6D88D527QTQT9DKHTRFN6EA","swift-protocol-di-testing","Protocol-based dependency injection for testable Swift code — mock file system, network, and external APIs using focused protocols and Swift Testing.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fswift-protocol-di-testing\u002FSKILL.md",[197],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[199,200,201,27,135,202,203,204,205,137,206,207,208],"swift protocol di testing","protocol","swift","protocols","file","network","injection","dependency","swift testing","dependency injection",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":215,"publishedAt":44},"01M6D88AJW8H2QNWSW5ZY82R43","swift-concurrency-6-2","Swift 6.2 Approachable Concurrency — single-threaded by default, @concurrent for explicit background offloading, isolated conformances for main actor types.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fswift-concurrency-6-2\u002FSKILL.md",[],[216,217,201,218,219,57],"concurrency","swift concurrency","swift concurrency 6 2","default"]