[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KB5J5MYW61FMMP482SMDNZ":3,"skill-same:01M6KB5J5MYW61FMMP482SMDNZ":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":6,"updatedAt":67,"install":68,"resources":81},"01M6KB5J5MYW61FMMP482SMDNZ","senior-security",null,"Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools. Use when the user asks about security reviews, threat analysis, vulnerability assessments, secure coding practices, security audits, attack surface analysis, CVE remediation, or security best practices.","afaizalam2003\u002FMaster-claude-skill","afaizalam2003","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F222019359?v=4","01M6K8F2XNT0HKBPF00JQ78SV3","Faiz Alam","01M6K8F31EBXAPER0EG8R9HTR5",3,"MIT","https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fengineering-team\u002Fsenior-security\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","senior security","secure coding practices","testing","for","reviews","security engineering","penetration","Secure Coding","trust","use","coding","security best practices","best practices","cve remediation","assessment","secure","architecture","threat modeling","application security","2026-11-10 10:12:30",false,"---\nname: \"senior-security\"\ndescription: Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools. Use when the user asks about security reviews, threat analysis, vulnerability assessments, secure coding practices, security audits, attack surface analysis, CVE remediation, or security best practices.\ntriggers:\n  - security architecture\n  - threat modeling\n  - STRIDE analysis\n  - penetration testing\n  - vulnerability assessment\n  - secure coding\n  - OWASP\n  - application security\n  - cryptography implementation\n  - secret scanning\n  - security audit\n  - zero trust\n---\n\n# Senior Security Engineer\n\nSecurity engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.\n\n---\n\n## Table of Contents\n\n- [Threat Modeling Workflow](#threat-modeling-workflow)\n- [Security Architecture Workflow](#security-architecture-workflow)\n- [Vulnerability Assessment Workflow](#vulnerability-assessment-workflow)\n- [Secure Code Review Workflow](#secure-code-review-workflow)\n- [Incident Response Workflow](#incident-response-workflow)\n- [Security Tools Reference](#security-tools-reference)\n- [Tools and References](#tools-and-references)\n\n---\n\n## Threat Modeling Workflow\n\nIdentify and analyze security threats using STRIDE methodology.\n\n### Workflow: Conduct Threat Model\n\n1. Define system scope and boundaries:\n   - Identify assets to protect\n   - Map trust boundaries\n   - Document data flows\n2. Create data flow diagram:\n   - External entities (users, services)\n   - Processes (application components)\n   - Data stores (databases, caches)\n   - Data flows (APIs, network connections)\n3. Apply STRIDE to each DFD element (see [STRIDE per Element Matrix](#stride-per-element-matrix) below)\n4. Score risks using DREAD:\n   - Damage potential (1-10)\n   - Reproducibility (1-10)\n   - Exploitability (1-10)\n   - Affected users (1-10)\n   - Discoverability (1-10)\n5. Prioritize threats by risk score\n6. Define mitigations for each threat\n7. Document in threat model report\n8. **Validation:** All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped\n\n### STRIDE Threat Categories\n\n| Category | Security Property | Mitigation Focus |\n|----------|-------------------|------------------|\n| Spoofing | Authentication | MFA, certificates, strong auth |\n| Tampering | Integrity | Signing, checksums, validation |\n| Repudiation | Non-repudiation | Audit logs, digital signatures |\n| Information Disclosure | Confidentiality | Encryption, access controls |\n| Denial of Service | Availability | Rate limiting, redundancy |\n| Elevation of Privilege | Authorization | RBAC, least privilege |\n\n### STRIDE per Element Matrix\n\n| DFD Element | S | T | R | I | D | E |\n|-------------|---|---|---|---|---|---|\n| External Entity | X | | X | | | |\n| Process | X | X | X | X | X | X |\n| Data Store | | X | X | X | X | |\n| Data Flow | | X | | X | X | |\n\nSee: [references\u002Fthreat-modeling-guide.md](references\u002Fthreat-modeling-guide.md)\n\n---\n\n## Security Architecture Workflow\n\nDesign secure systems using defense-in-depth principles.\n\n### Workflow: Design Secure Architecture\n\n1. Define security requirements:\n   - Compliance requirements (GDPR, HIPAA, PCI-DSS)\n   - Data classification (public, internal, confidential, restricted)\n   - Threat model inputs\n2. Apply defense-in-depth layers:\n   - Perimeter: WAF, DDoS protection, rate limiting\n   - Network: Segmentation, IDS\u002FIPS, mTLS\n   - Host: Patching, EDR, hardening\n   - Application: Input validation, authentication, secure coding\n   - Data: Encryption at rest and in transit\n3. Implement Zero Trust principles:\n   - Verify explicitly (every request)\n   - Least privilege access (JIT\u002FJEA)\n   - Assume breach (segment, monitor)\n4. Configure authentication and authorization:\n   - Identity provider selection\n   - MFA requirements\n   - RBAC\u002FABAC model\n5. Design encryption strategy:\n   - Key management approach\n   - Algorithm selection\n   - Certificate lifecycle\n6. Plan security monitoring:\n   - Log aggregation\n   - SIEM integration\n   - Alerting rules\n7. Document architecture decisions\n8. **Validation:** Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned\n\n### Defense-in-Depth Layers\n\n```\nLayer 1: PERIMETER\n  WAF, DDoS mitigation, DNS filtering, rate limiting\n\nLayer 2: NETWORK\n  Segmentation, IDS\u002FIPS, network monitoring, VPN, mTLS\n\nLayer 3: HOST\n  Endpoint protection, OS hardening, patching, logging\n\nLayer 4: APPLICATION\n  Input validation, authentication, secure coding, SAST\n\nLayer 5: DATA\n  Encryption at rest\u002Ftransit, access controls, DLP, backup\n```\n\n### Authentication Pattern Selection\n\n| Use Case | Recommended Pattern |\n|----------|---------------------|\n| Web application | OAuth 2.0 + PKCE with OIDC |\n| API authentication | JWT with short expiration + refresh tokens |\n| Service-to-service | mTLS with certificate rotation |\n| CLI\u002FAutomation | API keys with IP allowlisting |\n| High security | FIDO2\u002FWebAuthn hardware keys |\n\nSee: [references\u002Fsecurity-architecture-patterns.md](references\u002Fsecurity-architecture-patterns.md)\n\n---\n\n## Vulnerability Assessment Workflow\n\nIdentify and remediate security vulnerabilities in applications.\n\n### Workflow: Conduct Vulnerability Assessment\n\n1. Define assessment scope:\n   - In-scope systems and applications\n   - Testing methodology (black box, gray box, white box)\n   - Rules of engagement\n2. Gather information:\n   - Technology stack inventory\n   - Architecture documentation\n   - Previous vulnerability reports\n3. Perform automated scanning:\n   - SAST (static analysis)\n   - DAST (dynamic analysis)\n   - Dependency scanning\n   - Secret detection\n4. Conduct manual testing:\n   - Business logic flaws\n   - Authentication bypass\n   - Authorization issues\n   - Injection vulnerabilities\n5. Classify findings by severity:\n   - Critical: Immediate exploitation risk\n   - High: Significant impact, easier to exploit\n   - Medium: Moderate impact or difficulty\n   - Low: Minor impact\n6. Develop remediation plan:\n   - Prioritize by risk\n   - Assign owners\n   - Set deadlines\n7. Verify fixes and document\n8. **Validation:** Scope defined; automated and manual testing complete; findings classified; remediation tracked\n\nFor OWASP Top 10 vulnerability descriptions and testing guidance, refer to [owasp.org\u002FTop10](https:\u002F\u002Fowasp.org\u002FTop10).\n\n### Vulnerability Severity Matrix\n\n| Impact \\ Exploitability | Easy | Moderate | Difficult |\n|-------------------------|------|----------|-----------|\n| Critical | Critical | Critical | High |\n| High | Critical | High | Medium |\n| Medium | High | Medium | Low |\n| Low | Medium | Low | Low |\n\n---\n\n## Secure Code Review Workflow\n\nReview code for security vulnerabilities before deployment.\n\n### Workflow: Conduct Security Code Review\n\n1. Establish review scope:\n   - Changed files and functions\n   - Security-sensitive areas (auth, crypto, input handling)\n   - Third-party integrations\n2. Run automated analysis:\n   - SAST tools (Semgrep, CodeQL, Bandit)\n   - Secret scanning\n   - Dependency vulnerability check\n3. Review authentication code:\n   - Password handling (hashing, storage)\n   - Session management\n   - Token validation\n4. Review authorization code:\n   - Access control checks\n   - RBAC implementation\n   - Privilege boundaries\n5. Review data handling:\n   - Input validation\n   - Output encoding\n   - SQL query construction\n   - File path handling\n6. Review cryptographic code:\n   - Algorithm selection\n   - Key management\n   - Random number generation\n7. Document findings with severity\n8. **Validation:** Automated scans passed; auth\u002Fauthz reviewed; data handling checked; crypto verified; findings documented\n\n### Security Code Review Checklist\n\n| Category | Check | Risk |\n|----------|-------|------|\n| Input Validation | All user input validated and sanitized | Injection |\n| Output Encoding | Context-appropriate encoding applied | XSS |\n| Authentication | Passwords hashed with Argon2\u002Fbcrypt | Credential theft |\n| Session | Secure cookie flags set (HttpOnly, Secure, SameSite) | Session hijacking |\n| Authorization | Server-side permission checks on all endpoints | Privilege escalation |\n| SQL | Parameterized queries used exclusively | SQL injection |\n| File Access | Path traversal sequences rejected | Path traversal |\n| Secrets | No hardcoded credentials or keys | Information disclosure |\n| Dependencies | Known vulnerable packages updated | Supply chain |\n| Logging | Sensitive data not logged | Information disclosure |\n\n### Secure vs Insecure Patterns\n\n| Pattern | Issue | Secure Alternative |\n|---------|-------|-------------------|\n| SQL string formatting | SQL injection | Use parameterized queries with placeholders |\n| Shell command building | Command injection | Use subprocess with argument lists, no shell |\n| Path concatenation | Path traversal | Validate and canonicalize paths |\n| MD5\u002FSHA1 for passwords | Weak hashing | Use Argon2id or bcrypt |\n| Math.random for tokens | Predictable values | Use crypto.getRandomValues |\n\n### Inline Code Examples\n\n**SQL Injection — insecure vs. secure (Python):**\n\n```python\n# ❌ Insecure: string formatting allows SQL injection\nquery = f\"SELECT * FROM users WHERE username = '{username}'\"\ncursor.execute(query)\n\n# ✅ Secure: parameterized query — user input never interpreted as SQL\nquery = \"SELECT * FROM users WHERE username = %s\"\ncursor.execute(query, (username,))\n```\n\n**Password Hashing with Argon2id (Python):**\n\n```python\nfrom argon2 import PasswordHasher\n\nph = PasswordHasher()          # uses secure defaults (time_cost, memory_cost)\n\n# On registration\nhashed = ph.hash(plain_password)\n\n# On login — raises argon2.exceptions.VerifyMismatchError on failure\nph.verify(hashed, plain_password)\n```\n\n**Secret Scanning — core pattern matching (Python):**\n\n```python\nimport re, pathlib\n\nSECRET_PATTERNS = {\n    \"aws_access_key\":  re.compile(r\"AKIA[0-9A-Z]{16}\"),\n    \"github_token\":    re.compile(r\"ghp_[A-Za-z0-9]{36}\"),\n    \"private_key\":     re.compile(r\"-----BEGIN (RSA |EC )?PRIVATE KEY-----\"),\n    \"generic_secret\":  re.compile(r'(?i)(password|secret|api_key)\\s*=\\s*[\"\\']?\\S{8,}'),\n}\n\ndef scan_file(path: pathlib.Path) -> list[dict]:\n    findings = []\n    for lineno, line in enumerate(path.read_text(errors=\"replace\").splitlines(), 1):\n        for name, pattern in SECRET_PATTERNS.items():\n            if pattern.search(line):\n                findings.append({\"file\": str(path), \"line\": lineno, \"type\": name})\n    return findings\n```\n\n---\n\n## Incident Response Workflow\n\nRespond to and contain security incidents.\n\n### Workflow: Handle Security Incident\n\n1. Identify and triage:\n   - Validate incident is genuine\n   - Assess initial scope and severity\n   - Activate incident response team\n2. Contain the threat:\n   - Isolate affected systems\n   - Block malicious IPs\u002Faccounts\n   - Disable compromised credentials\n3. Eradicate root cause:\n   - Remove malware\u002Fbackdoors\n   - Patch vulnerabilities\n   - Update configurations\n4. Recover operations:\n   - Restore from clean backups\n   - Verify system integrity\n   - Monitor for recurrence\n5. Conduct post-mortem:\n   - Timeline reconstruction\n   - Root cause analysis\n   - Lessons learned\n6. Implement improvements:\n   - Update detection rules\n   - Enhance controls\n   - Update runbooks\n7. Document and report\n8. **Validation:** Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented\n\n### Incident Severity Levels\n\n| Level | Response Time | Escalation |\n|-------|---------------|------------|\n| P1 - Critical (active breach\u002Fexfiltration) | Immediate | CISO, Legal, Executive |\n| P2 - High (confirmed, contained) | 1 hour | Security Lead, IT Director |\n| P3 - Medium (potential, under investigation) | 4 hours | Security Team |\n| P4 - Low (suspicious, low impact) | 24 hours | On-call engineer |\n\n### Incident Response Checklist\n\n| Phase | Actions |\n|-------|---------|\n| Identification | Validate alert, assess scope, determine severity |\n| Containment | Isolate systems, preserve evidence, block access |\n| Eradication | Remove threat, patch vulnerabilities, reset credentials |\n| Recovery | Restore services, verify integrity, increase monitoring |\n| Lessons Learned | Document timeline, identify gaps, update procedures |\n\n---\n\n## Security Tools Reference\n\n### Recommended Security Tools\n\n| Category | Tools |\n|----------|-------|\n| SAST | Semgrep, CodeQL, Bandit (Python), ESLint security plugins |\n| DAST | OWASP ZAP, Burp Suite, Nikto |\n| Dependency Scanning | Snyk, Dependabot, npm audit, pip-audit |\n| Secret Detection | GitLeaks, TruffleHog, detect-secrets |\n| Container Security | Trivy, Clair, Anchore |\n| Infrastructure | Checkov, tfsec, ScoutSuite |\n| Network | Wireshark, Nmap, Masscan |\n| Penetration | Metasploit, sqlmap, Burp Suite Pro |\n\n### Cryptographic Algorithm Selection\n\n| Use Case | Algorithm | Key Size |\n|----------|-----------|----------|\n| Symmetric encryption | AES-256-GCM | 256 bits |\n| Password hashing | Argon2id | N\u002FA (use defaults) |\n| Message authentication | HMAC-SHA256 | 256 bits |\n| Digital signatures | Ed25519 | 256 bits |\n| Key exchange | X25519 | 256 bits |\n| TLS | TLS 1.3 | N\u002FA |\n\nSee: [references\u002Fcryptography-implementation.md](references\u002Fcryptography-implementation.md)\n\n---\n\n## Tools and References\n\n### Scripts\n\n| Script | Purpose |\n|--------|---------|\n| [threat_modeler.py](scripts\u002Fthreat_modeler.py) | STRIDE threat analysis with DREAD risk scoring; JSON and text output; interactive guided mode |\n| [secret_scanner.py](scripts\u002Fsecret_scanner.py) | Detect hardcoded secrets and credentials across 20+ patterns; CI\u002FCD integration ready |\n\nFor usage, see the inline code examples in [Secure Code Review Workflow](#inline-code-examples) and the script source files directly.\n\n### References\n\n| Document | Content |\n|----------|---------|\n| [security-architecture-patterns.md](references\u002Fsecurity-architecture-patterns.md) | Zero Trust, defense-in-depth, authentication patterns, API security |\n| [threat-modeling-guide.md](references\u002Fthreat-modeling-guide.md) | STRIDE methodology, attack trees, DREAD scoring, DFD creation |\n| [cryptography-implementation.md](references\u002Fcryptography-implementation.md) | AES-GCM, RSA, Ed25519, password hashing, key management |\n\n---\n\n## Security Standards Reference\n\n### Security Headers Checklist\n\n| Header | Recommended Value |\n|--------|-------------------|\n| Content-Security-Policy | default-src self; script-src self |\n| X-Frame-Options | DENY |\n| X-Content-Type-Options | nosniff |\n| Strict-Transport-Security | max-age=31536000; includeSubDomains |\n| Referrer-Policy | strict-origin-when-cross-origin |\n| Permissions-Policy | geolocation=(), microphone=(), camera=() |\n\nFor compliance framework requirements (OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, SOC 2), refer to the respective official documentation.\n\n---\n\n## Related Skills\n\n| Skill | Integration Point |\n|-------|-------------------|\n| [senior-devops](..\u002Fsenior-devops\u002F) | CI\u002FCD security, infrastructure hardening |\n| [senior-secops](..\u002Fsenior-secops\u002F) | Security monitoring, incident response |\n| [senior-backend](..\u002Fsenior-backend\u002F) | Secure API development |\n| [senior-architect](..\u002Fsenior-architect\u002F) | Security architecture decisions |\n","# Senior Security Engineer\n\nSecurity engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.\n\n---\n\n## Table of Contents\n\n- [Threat Modeling Workflow](#threat-modeling-workflow)\n- [Security Architecture Workflow](#security-architecture-workflow)\n- [Vulnerability Assessment Workflow](#vulnerability-assessment-workflow)\n- [Secure Code Review Workflow](#secure-code-review-workflow)\n- [Incident Response Workflow](#incident-response-workflow)\n- [Security Tools Reference](#security-tools-reference)\n- [Tools and References](#tools-and-references)\n\n---\n\n## Threat Modeling Workflow\n\nIdentify and analyze security threats using STRIDE methodology.\n\n### Workflow: Conduct Threat Model\n\n1. Define system scope and boundaries:\n   - Identify assets to protect\n   - Map trust boundaries\n   - Document data flows\n2. Create data flow diagram:\n   - External entities (users, services)\n   - Processes (application components)\n   - Data stores (databases, caches)\n   - Data flows (APIs, network connections)\n3. Apply STRIDE to each DFD element (see [STRIDE per Element Matrix](#stride-per-element-matrix) below)\n4. Score risks using DREAD:\n   - Damage potential (1-10)\n   - Reproducibility (1-10)\n   - Exploitability (1-10)\n   - Affected users (1-10)\n   - Discoverability (1-10)\n5. Prioritize threats by risk score\n6. Define mitigations for each threat\n7. Document in threat model report\n8. **Validation:** All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped\n\n### STRIDE Threat Categories\n\n| Category | Security Property | Mitigation Focus |\n|----------|-------------------|------------------|\n| Spoofing | Authentication | MFA, certificates, strong auth |\n| Tampering | Integrity | Signing, checksums, validation |\n| Repudiation | Non-repudiation | Audit logs, digital signatures |\n| Information Disclosure | Confidentiality | Encryption, access controls |\n| Denial of Service | Availability | Rate limiting, redundancy |\n| Elevation of Privilege | Authorization | RBAC, least privilege |\n\n### STRIDE per Element Matrix\n\n| DFD Element | S | T | R | I | D | E |\n|-------------|---|---|---|---|---|---|\n| External Entity | X | | X | | | |\n| Process | X | X | X | X | X | X |\n| Data Store | | X | X | X | X | |\n| Data Flow | | X | | X | X | |\n\nSee: [references\u002Fthreat-modeling-guide.md](references\u002Fthreat-modeling-guide.md)\n\n---\n\n## Security Architecture Workflow\n\nDesign secure systems using defense-in-depth principles.\n\n### Workflow: Design Secure Architecture\n\n1. Define security requirements:\n   - Compliance requirements (GDPR, HIPAA, PCI-DSS)\n   - Data classification (public, internal, confidential, restricted)\n   - Threat model inputs\n2. Apply defense-in-depth layers:\n   - Perimeter: WAF, DDoS protection, rate limiting\n   - Network: Segmentation, IDS\u002FIPS, mTLS\n   - Host: Patching, EDR, hardening\n   - Application: Input validation, authentication, secure coding\n   - Data: Encryption at rest and in transit\n3. Implement Zero Trust principles:\n   - Verify explicitly (every request)\n   - Least privilege access (JIT\u002FJEA)\n   - Assume breach (segment, monitor)\n4. Configure authentication and authorization:\n   - Identity provider selection\n   - MFA requirements\n   - RBAC\u002FABAC model\n5. Design encryption strategy:\n   - Key management approach\n   - Algorithm selection\n   - Certificate lifecycle\n6. Plan security monitoring:\n   - Log aggregation\n   - SIEM integration\n   - Alerting rules\n7. Document architecture decisions\n8. **Validation:** Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned\n\n### Defense-in-Depth Layers\n\n```\nLayer 1: PERIMETER\n  WAF, DDoS mitigation, DNS filtering, rate limiting\n\nLayer 2: NETWORK\n  Segmentation, IDS\u002FIPS, network monitoring, VPN, mTLS\n\nLayer 3: HOST\n  Endpoint protection, OS hardening, patching, logging\n\nLayer 4: APPLICATION\n  Input validation, authentication, secure coding, SAST\n\nLayer 5: DATA\n  Encryption at rest\u002Ftransit, access controls, DLP, backup\n```\n\n### Authentication Pattern Selection\n\n| Use Case | Recommended Pattern |\n|----------|---------------------|\n| Web application | OAuth 2.0 + PKCE with OIDC |\n| API authentication | JWT with short expiration + refresh tokens |\n| Service-to-service | mTLS with certificate rotation |\n| CLI\u002FAutomation | API keys with IP allowlisting |\n| High security | FIDO2\u002FWebAuthn hardware keys |\n\nSee: [references\u002Fsecurity-architecture-patterns.md](references\u002Fsecurity-architecture-patterns.md)\n\n---\n\n## Vulnerability Assessment Workflow\n\nIdentify and remediate security vulnerabilities in applications.\n\n### Workflow: Conduct Vulnerability Assessment\n\n1. Define assessment scope:\n   - In-scope systems and applications\n   - Testing methodology (black box, gray box, white box)\n   - Rules of engagement\n2. Gather information:\n   - Technology stack inventory\n   - Architecture documentation\n   - Previous vulnerability reports\n3. Perform automated scanning:\n   - SAST (static analysis)\n   - DAST (dynamic analysis)\n   - Dependency scanning\n   - Secret detection\n4. Conduct manual testing:\n   - Business logic flaws\n   - Authentication bypass\n   - Authorization issues\n   - Injection vulnerabilities\n5. Classify findings by severity:\n   - Critical: Immediate exploitation risk\n   - High: Significant impact, easier to exploit\n   - Medium: Moderate impact or difficulty\n   - Low: Minor impact\n6. Develop remediation plan:\n   - Prioritize by risk\n   - Assign owners\n   - Set deadlines\n7. Verify fixes and document\n8. **Validation:** Scope defined; automated and manual testing complete; findings classified; remediation tracked\n\nFor OWASP Top 10 vulnerability descriptions and testing guidance, refer to [owasp.org\u002FTop10](https:\u002F\u002Fowasp.org\u002FTop10).\n\n### Vulnerability Severity Matrix\n\n| Impact \\ Exploitability | Easy | Moderate | Difficult |\n|-------------------------|------|----------|-----------|\n| Critical | Critical | Critical | High |\n| High | Critical | High | Medium |\n| Medium | High | Medium | Low |\n| Low | Medium | Low | Low |\n\n---\n\n## Secure Code Review Workflow\n\nReview code for security vulnerabilities before deployment.\n\n### Workflow: Conduct Security Code Review\n\n1. Establish review scope:\n   - Changed files and functions\n   - Security-sensitive areas (auth, crypto, input handling)\n   - Third-party integrations\n2. Run automated analysis:\n   - SAST tools (Semgrep, CodeQL, Bandit)\n   - Secret scanning\n   - Dependency vulnerability check\n3. Review authentication code:\n   - Password handling (hashing, storage)\n   - Session management\n   - Token validation\n4. Review authorization code:\n   - Access control checks\n   - RBAC implementation\n   - Privilege boundaries\n5. Review data handling:\n   - Input validation\n   - Output encoding\n   - SQL query construction\n   - File path handling\n6. Review cryptographic code:\n   - Algorithm selection\n   - Key management\n   - Random number generation\n7. Document findings with severity\n8. **Validation:** Automated scans passed; auth\u002Fauthz reviewed; data handling checked; crypto verified; findings documented\n\n### Security Code Review Checklist\n\n| Category | Check | Risk |\n|----------|-------|------|\n| Input Validation | All user input validated and sanitized | Injection |\n| Output Encoding | Context-appropriate encoding applied | XSS |\n| Authentication | Passwords hashed with Argon2\u002Fbcrypt | Credential theft |\n| Session | Secure cookie flags set (HttpOnly, Secure, SameSite) | Session hijacking |\n| Authorization | Server-side permission checks on all endpoints | Privilege escalation |\n| SQL | Parameterized queries used exclusively | SQL injection |\n| File Access | Path traversal sequences rejected | Path traversal |\n| Secrets | No hardcoded credentials or keys | Information disclosure |\n| Dependencies | Known vulnerable packages updated | Supply chain |\n| Logging | Sensitive data not logged | Information disclosure |\n\n### Secure vs Insecure Patterns\n\n| Pattern | Issue | Secure Alternative |\n|---------|-------|-------------------|\n| SQL string formatting | SQL injection | Use parameterized queries with placeholders |\n| Shell command building | Command injection | Use subprocess with argument lists, no shell |\n| Path concatenation | Path traversal | Validate and canonicalize paths |\n| MD5\u002FSHA1 for passwords | Weak hashing | Use Argon2id or bcrypt |\n| Math.random for tokens | Predictable values | Use crypto.getRandomValues |\n\n### Inline Code Examples\n\n**SQL Injection — insecure vs. secure (Python):**\n\n```python\n# ❌ Insecure: string formatting allows SQL injection\nquery = f\"SELECT * FROM users WHERE username = '{username}'\"\ncursor.execute(query)\n\n# ✅ Secure: parameterized query — user input never interpreted as SQL\nquery = \"SELECT * FROM users WHERE username = %s\"\ncursor.execute(query, (username,))\n```\n\n**Password Hashing with Argon2id (Python):**\n\n```python\nfrom argon2 import PasswordHasher\n\nph = PasswordHasher()          # uses secure defaults (time_cost, memory_cost)\n\n# On registration\nhashed = ph.hash(plain_password)\n\n# On login — raises argon2.exceptions.VerifyMismatchError on failure\nph.verify(hashed, plain_password)\n```\n\n**Secret Scanning — core pattern matching (Python):**\n\n```python\nimport re, pathlib\n\nSECRET_PATTERNS = {\n    \"aws_access_key\":  re.compile(r\"AKIA[0-9A-Z]{16}\"),\n    \"github_token\":    re.compile(r\"ghp_[A-Za-z0-9]{36}\"),\n    \"private_key\":     re.compile(r\"-----BEGIN (RSA |EC )?PRIVATE KEY-----\"),\n    \"generic_secret\":  re.compile(r'(?i)(password|secret|api_key)\\s*=\\s*[\"\\']?\\S{8,}'),\n}\n\ndef scan_file(path: pathlib.Path) -> list[dict]:\n    findings = []\n    for lineno, line in enumerate(path.read_text(errors=\"replace\").splitlines(), 1):\n        for name, pattern in SECRET_PATTERNS.items():\n            if pattern.search(line):\n                findings.append({\"file\": str(path), \"line\": lineno, \"type\": name})\n    return findings\n```\n\n---\n\n## Incident Response Workflow\n\nRespond to and contain security incidents.\n\n### Workflow: Handle Security Incident\n\n1. Identify and triage:\n   - Validate incident is genuine\n   - Assess initial scope and severity\n   - Activate incident response team\n2. Contain the threat:\n   - Isolate affected systems\n   - Block malicious IPs\u002Faccounts\n   - Disable compromised credentials\n3. Eradicate root cause:\n   - Remove malware\u002Fbackdoors\n   - Patch vulnerabilities\n   - Update configurations\n4. Recover operations:\n   - Restore from clean backups\n   - Verify system integrity\n   - Monitor for recurrence\n5. Conduct post-mortem:\n   - Timeline reconstruction\n   - Root cause analysis\n   - Lessons learned\n6. Implement improvements:\n   - Update detection rules\n   - Enhance controls\n   - Update runbooks\n7. Document and report\n8. **Validation:** Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented\n\n### Incident Severity Levels\n\n| Level | Response Time | Escalation |\n|-------|---------------|------------|\n| P1 - Critical (active breach\u002Fexfiltration) | Immediate | CISO, Legal, Executive |\n| P2 - High (confirmed, contained) | 1 hour | Security Lead, IT Director |\n| P3 - Medium (potential, under investigation) | 4 hours | Security Team |\n| P4 - Low (suspicious, low impact) | 24 hours | On-call engineer |\n\n### Incident Response Checklist\n\n| Phase | Actions |\n|-------|---------|\n| Identification | Validate alert, assess scope, determine severity |\n| Containment | Isolate systems, preserve evidence, block access |\n| Eradication | Remove threat, patch vulnerabilities, reset credentials |\n| Recovery | Restore services, verify integrity, increase monitoring |\n| Lessons Learned | Document timeline, identify gaps, update procedures |\n\n---\n\n## Security Tools Reference\n\n### Recommended Security Tools\n\n| Category | Tools |\n|----------|-------|\n| SAST | Semgrep, CodeQL, Bandit (Python), ESLint security plugins |\n| DAST | OWASP ZAP, Burp Suite, Nikto |\n| Dependency Scanning | Snyk, Dependabot, npm audit, pip-audit |\n| Secret Detection | GitLeaks, TruffleHog, detect-secrets |\n| Container Security | Trivy, Clair, Anchore |\n| Infrastructure | Checkov, tfsec, ScoutSuite |\n| Network | Wireshark, Nmap, Masscan |\n| Penetration | Metasploit, sqlmap, Burp Suite Pro |\n\n### Cryptographic Algorithm Selection\n\n| Use Case | Algorithm | Key Size |\n|----------|-----------|----------|\n| Symmetric encryption | AES-256-GCM | 256 bits |\n| Password hashing | Argon2id | N\u002FA (use defaults) |\n| Message authentication | HMAC-SHA256 | 256 bits |\n| Digital signatures | Ed25519 | 256 bits |\n| Key exchange | X25519 | 256 bits |\n| TLS | TLS 1.3 | N\u002FA |\n\nSee: [references\u002Fcryptography-implementation.md](references\u002Fcryptography-implementation.md)\n\n---\n\n## Tools and References\n\n### Scripts\n\n| Script | Purpose |\n|--------|---------|\n| [threat_modeler.py](scripts\u002Fthreat_modeler.py) | STRIDE threat analysis with DREAD risk scoring; JSON and text output; interactive guided mode |\n| [secret_scanner.py](scripts\u002Fsecret_scanner.py) | Detect hardcoded secrets and credentials across 20+ patterns; CI\u002FCD integration ready |\n\nFor usage, see the inline code examples in [Secure Code Review Workflow](#inline-code-examples) and the script source files directly.\n\n### References\n\n| Document | Content |\n|----------|---------|\n| [security-architecture-patterns.md](references\u002Fsecurity-architecture-patterns.md) | Zero Trust, defense-in-depth, authentication patterns, API security |\n| [threat-modeling-guide.md](references\u002Fthreat-modeling-guide.md) | STRIDE methodology, attack trees, DREAD scoring, DFD creation |\n| [cryptography-implementation.md](references\u002Fcryptography-implementation.md) | AES-GCM, RSA, Ed25519, password hashing, key management |\n\n---\n\n## Security Standards Reference\n\n### Security Headers Checklist\n\n| Header | Recommended Value |\n|--------|-------------------|\n| Content-Security-Policy | default-src self; script-src self |\n| X-Frame-Options | DENY |\n| X-Content-Type-Options | nosniff |\n| Strict-Transport-Security | max-age=31536000; includeSubDomains |\n| Referrer-Policy | strict-origin-when-cross-origin |\n| Permissions-Policy | geolocation=(), microphone=(), camera=() |\n\nFor compliance framework requirements (OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, SOC 2), refer to the respective official documentation.\n\n---\n\n## Related Skills\n\n| Skill | Integration Point |\n|-------|-------------------|\n| [senior-devops](..\u002Fsenior-devops\u002F) | CI\u002FCD security, infrastructure hardening |\n| [senior-secops](..\u002Fsenior-secops\u002F) | Security monitoring, incident response |\n| [senior-backend](..\u002Fsenior-backend\u002F) | Secure API development |\n| [senior-architect](..\u002Fsenior-architect\u002F) | Security architecture decisions |\n",{"name":5,"triggers":49,"description":7},[50,42,51,52,53,54,55,43,56,57,58,59],"security architecture","STRIDE analysis","penetration testing","vulnerability assessment","secure coding","OWASP","cryptography implementation","secret scanning","security audit","zero trust","main","0b48cbb0e6d5be6ff68c0f6b28bc0c65ee21c4a1","engineering-team\u002Fsenior-security",2,"https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill","https:\u002F\u002Fgithub.com\u002Fafaizalam2003","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmdfaizalam2003\u002F","2026-04-01 04:35:43",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add afaizalam2003\u002FMaster-claude-skill --skill senior-security",{"tool":74,"command":75},"bunx","bunx skills add afaizalam2003\u002FMaster-claude-skill --skill senior-security",{"tool":77,"command":78},"pnpm","pnpm dlx skills add afaizalam2003\u002FMaster-claude-skill --skill senior-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fengineering-team\u002Fsenior-security\u002FSKILL.md",true,[82,88,92,96,102],{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fcryptography-implementation.md","REFERENCE","参考文档",21912,"https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fengineering-team\u002Fsenior-security\u002Freferences\u002Fcryptography-implementation.md",{"path":89,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fsecurity-architecture-patterns.md",22198,"https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fengineering-team\u002Fsenior-security\u002Freferences\u002Fsecurity-architecture-patterns.md",{"path":93,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fthreat-modeling-guide.md",22659,"https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fengineering-team\u002Fsenior-security\u002Freferences\u002Fthreat-modeling-guide.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fsecret_scanner.py","SCRIPT","脚本",18120,"https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fengineering-team\u002Fsenior-security\u002Fscripts\u002Fsecret_scanner.py",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fthreat_modeler.py",21325,"https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fengineering-team\u002Fsenior-security\u002Fscripts\u002Fthreat_modeler.py",[107,136,161,186,216,236],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":118,"publishedAt":44},"01M6KC4E8MYR9DBAZTAXHKYMMH","soc2-compliance","Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type II readiness.","https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fra-qm-team\u002Fsoc2-compliance\u002FSKILL.md",[113],{"categoryNo":114,"categoryName":115,"taxonomyType":116,"taxonomyTypeDesc":117},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[119,120,121,122,123,124,125,126,34,127,33,128,129,130,131,132,133,134,135,28],"compliance","soc2","soc2 compliance","audit evidence","audit","collect","soc","analysis","evidence","build","map","control","type","gap","readiness","gap analysis","assess",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":44},"01M6KC461R3GKGZ1TAYHVR1MW9","risk-management-specialist","Medical device risk management specialist implementing ISO 14971 throughout product lifecycle. Provides risk analysis, risk evaluation, risk control, and post-production information analysis. Use when user mentions risk management, ISO 14971, risk analysis, FMEA, fault tree analysis, hazard identification, risk control, risk matrix, benefit-risk analysis, residual risk, risk acceptability, or post-market risk.","https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fra-qm-team\u002Frisk-management-specialist\u002FSKILL.md",[],[143,144,145,146,147,148,149,150,126,34,151,152,153,154,155,156,157,158,159,160],"risk","risk management specialist","management","risk management","risk evaluation","product","Evaluation","lifecycle","risk matrix","iso","medical","iso 14971","identification","information","post-production","tree","matrix","implementing",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":44},"01M6KC3HF5ZFSSP2NZF68PEPFB","regulatory-affairs-head","Senior Regulatory Affairs Manager for HealthTech and MedTech companies. Prepares FDA 510(k), De Novo, and PMA submission packages; analyzes regulatory pathways for new medical devices; drafts responses to FDA deficiency letters and Notified Body queries; develops CE marking technical documentation under EU MDR 2017\u002F745; coordinates multi-market approval strategies across FDA, EU, Health Canada, PMDA, and NMPA; and maintains regulatory intelligence on evolving standards. Use when users need to plan or execute FDA submissions, navigate 510(k) or PMA approval processes, achieve CE marking, prepare pre-submission meeting materials, write regulatory strategy documents, respond to agency queries, or manage compliance documentation for medical device market access.","https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fra-qm-team\u002Fregulatory-affairs-head\u002FSKILL.md",[],[168,169,170,171,172,173,174,175,176,34,177,178,179,180,181,182,183,184,185,28],"regulatory affairs head","regulatory","head","documents","devices","health","plan","write","strategy","standards","queries","manage","strategies","de","users","respond","medical devices","manager",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":198,"publishedAt":44},"01M6KC34Z8M1559EY1CXYBJB1A","quality-manager-qms-iso13485","ISO 13485 Quality Management System implementation and maintenance for medical device organizations. Provides QMS design, documentation control, internal auditing, CAPA management, and certification support. Use when working with medical device quality systems, preparing for ISO 13485 audits, managing regulatory compliance documentation, setting up corrective actions, or building audit preparation programs. Useful for quality management, audit preparation, regulatory compliance, medical device documentation, and corrective action workflows.","https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fra-qm-team\u002Fquality-manager-qms-iso13485\u002FSKILL.md",[192,195],{"categoryNo":193,"categoryName":194,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":196,"categoryName":197,"taxonomyType":116,"taxonomyTypeDesc":117},"01JBSEEDCAT000000000000032","设计师",[199,200,185,201,202,203,204,205,206,34,207,208,209,210,211,212,213,214,28,215],"quality manager qms iso13485","quality","design","workflows","validation","actions","certification","system","maintenance","document","systems","records","ISO 13485","organizations","corrective action","internal audit","preparation",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":44},"01M6KC2FXHBHXYX2ZZ17Y3GDB4","quality-manager-qmr","Senior Quality Manager Responsible Person (QMR) for HealthTech and MedTech companies. Provides quality system governance, management review leadership, regulatory compliance oversight, and quality performance monitoring per ISO 13485 Clause 5.5.2.","https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fra-qm-team\u002Fquality-manager-qmr\u002FSKILL.md",[222],{"categoryNo":114,"categoryName":115,"taxonomyType":116,"taxonomyTypeDesc":117},[224,200,185,225,226,227,228,229,119,230,206,231,169,232,233,234,152,211,28,235],"quality manager qmr","review","policy","performance","governance","monitoring","regulatory compliance","oversight","cost","culture","leadership","person",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":249,"publishedAt":44},"01M6KC1VRR5JTDBNZANHPS6VR6","quality-documentation-manager","Document control system management for medical device QMS. Covers document numbering, version control, change management, and 21 CFR Part 11 compliance. Use for document control procedures, change control workflow, document numbering, version management, electronic signature compliance, or regulatory documentation review.","https:\u002F\u002Fgithub.com\u002Fafaizalam2003\u002FMaster-claude-skill\u002Fblob\u002Fmain\u002Fra-qm-team\u002Fquality-documentation-manager\u002FSKILL.md",[242,245,248],{"categoryNo":243,"categoryName":244,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":246,"categoryName":247,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":114,"categoryName":115,"taxonomyType":116,"taxonomyTypeDesc":117},[250,251,200,185,225,252,253,123,206,254,255,256,257,258,153,259,260,261,262,28],"documentation","quality documentation manager","workflow","change","change management","list","master","system management","documentation review","cfr","21 cfr part 11","change control","retention"]