[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71NXM2ACN1WX2AH4JAYHRR5":3,"skill-same:01M71NXM2ACN1WX2AH4JAYHRR5":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":49,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":6,"updatedAt":57,"install":58,"resources":71},"01M71NXM2ACN1WX2AH4JAYHRR5","security-architect",null,"Use when an org role acts as security architect and must design security in before build: threat models, trust boundaries, zero-trust and authn\u002Fauthz patterns. Covers STRIDE, least privilege, defense in depth, secrets architecture, OIDC and mTLS, and ADRs for security controls.","monoes\u002Fmonomind","monoes","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F276744696?v=4","01M71KWF37AJ2NJBP3KWBVSDGT","01M71KWF4CSF8ADH0M6HA09VD2",23,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fsecurity-architect\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"architect","security architect","security","trust","as","context","threat","patterns","org","defense","mtls","secrets","monomind","zero-trust","architecture","query","when","impact","design","design security","2026-11-10 10:56:23",false,"---\nname: security-architect\ndescription: \"Use when an org role acts as security architect and must design security in before build: threat models, trust boundaries, zero-trust and authn\u002Fauthz patterns. Covers STRIDE, least privilege, defense in depth, secrets architecture, OIDC and mTLS, and ADRs for security controls.\"\ntags: [\"security\",\"architecture\",\"planning\"]\ntools: [\"monograph_query\",\"monograph_context\",\"monograph_impact\"]\nlicense: Apache-2.0\nsource: https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\n---\n# Security Architect — Best Practices\n\n## Focus\nDesigns security into systems before they're built — threat models, trust boundaries, zero-trust architecture, and authn\u002Fauthz patterns — so vulnerabilities never get a chance to ship.\n\n## Best practices\n- Threat-model every new component with STRIDE (or equivalent) before implementation, not after — identify trust boundaries, data classification, and attack surface up front\n- Default to deny: least-privilege access control, allowlists over blocklists, explicit grants over implicit trust\n- Design defense-in-depth — no single control (a WAF, an auth check) should be the only thing standing between an attacker and sensitive data\n- Prefer well-tested libraries and platform primitives (OAuth 2.0\u002FOIDC, KMS-backed encryption) over custom cryptography or homegrown auth\n- Treat secrets as first-class architecture concerns: centralized secrets management, rotation policy, and zero secrets in code, logs, or config\n- Build security requirements into the SDLC as testable acceptance criteria, not a review-gate afterthought\n- Document trust boundaries explicitly in every design doc — where does untrusted input enter, and what validates it there\n\n## Common pitfalls\n- Bolting security on after the architecture is finalized instead of shaping the architecture around it\n- Designing auth\u002Fauthz systems from scratch when a proven standard (OIDC, RBAC\u002FABAC libraries) would do\n- Treating \"internal network\" or \"behind the VPN\" as a substitute for authentication and authorization\n- Over-engineering security for the actual risk profile — a zero-trust mesh for an internal admin tool nobody attacks is wasted effort\n- Leaving error messages, stack traces, or verbose logs that leak internal architecture to unauthenticated callers\n\n## Tools & techniques\n- STRIDE \u002F DREAD threat modeling frameworks for structured risk analysis\n- Architecture Decision Records (ADRs) to capture *why* a security control was chosen, so it isn't silently removed later\n- SAST\u002FDAST\u002FSCA tooling wired into CI (Semgrep, Trivy, Gitleaks) as a safety net for the architecture's assumptions\n- Security headers and CSP as the last line of defense for web surfaces (X-Frame-Options, Strict-Transport-Security, Content-Security-Policy)\n- Reference architecture patterns: OAuth 2.0\u002FOIDC for identity, mTLS or service mesh for service-to-service trust, envelope encryption for data at rest\n","# Security Architect — Best Practices\n\n## Focus\nDesigns security into systems before they're built — threat models, trust boundaries, zero-trust architecture, and authn\u002Fauthz patterns — so vulnerabilities never get a chance to ship.\n\n## Best practices\n- Threat-model every new component with STRIDE (or equivalent) before implementation, not after — identify trust boundaries, data classification, and attack surface up front\n- Default to deny: least-privilege access control, allowlists over blocklists, explicit grants over implicit trust\n- Design defense-in-depth — no single control (a WAF, an auth check) should be the only thing standing between an attacker and sensitive data\n- Prefer well-tested libraries and platform primitives (OAuth 2.0\u002FOIDC, KMS-backed encryption) over custom cryptography or homegrown auth\n- Treat secrets as first-class architecture concerns: centralized secrets management, rotation policy, and zero secrets in code, logs, or config\n- Build security requirements into the SDLC as testable acceptance criteria, not a review-gate afterthought\n- Document trust boundaries explicitly in every design doc — where does untrusted input enter, and what validates it there\n\n## Common pitfalls\n- Bolting security on after the architecture is finalized instead of shaping the architecture around it\n- Designing auth\u002Fauthz systems from scratch when a proven standard (OIDC, RBAC\u002FABAC libraries) would do\n- Treating \"internal network\" or \"behind the VPN\" as a substitute for authentication and authorization\n- Over-engineering security for the actual risk profile — a zero-trust mesh for an internal admin tool nobody attacks is wasted effort\n- Leaving error messages, stack traces, or verbose logs that leak internal architecture to unauthenticated callers\n\n## Tools & techniques\n- STRIDE \u002F DREAD threat modeling frameworks for structured risk analysis\n- Architecture Decision Records (ADRs) to capture *why* a security control was chosen, so it isn't silently removed later\n- SAST\u002FDAST\u002FSCA tooling wired into CI (Semgrep, Trivy, Gitleaks) as a safety net for the architecture's assumptions\n- Security headers and CSP as the last line of defense for web surfaces (X-Frame-Options, Strict-Transport-Security, Content-Security-Policy)\n- Reference architecture patterns: OAuth 2.0\u002FOIDC for identity, mTLS or service mesh for service-to-service trust, envelope encryption for data at rest\n",{"name":5,"tags":43,"tools":45,"source":49,"license":14,"description":7},[20,32,44],"planning",[46,47,48],"monograph_query","monograph_context","monograph_impact","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind","main","f7cd4595d0f8959822163e14f9787117765c931a","packages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fsecurity-architect",2,"https:\u002F\u002Fmonoes.github.io\u002Fmonomind\u002F","https:\u002F\u002Fgithub.com\u002Fmonoes","https:\u002F\u002Fmonoes.me","2026-11-10 01:53:48",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add monoes\u002Fmonomind --skill security-architect",{"tool":64,"command":65},"bunx","bunx skills add monoes\u002Fmonomind --skill security-architect",{"tool":67,"command":68},"pnpm","pnpm dlx skills add monoes\u002Fmonomind --skill security-architect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fsecurity-architect\u002FSKILL.md",true,[],[73,95,130,157,182,209],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":94},"01M71PB3SHWKMNJM6MD65VX8D6","zk-steward","Org role guidance for a ZK steward: engineer zero-knowledge proof systems with circuit design, SNARK vs STARK choice and security review. This is zero-knowledge cryptography, not Zettelkasten note-taking.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fzk-steward\u002FSKILL.md",[],[80,81,82,83,84,85,36,86,35,33,87,88,30,89,90,91,92,20,26,93],"zk","zk steward","steward","zero-knowledge","engineer","choice","knowledge","snark","review","security review","stark","zettelkasten","cryptography","blockchain","2026-11-10 13:02:02",{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":100,"sourceHtmlUrl":101,"categories":102,"keywords":113,"publishedAt":94},"01M71PB18SDG28WBKPKJNB814K","writing-plans","Use when you have a spec or requirements for a multi-step coding task and must write an implementation plan before touching code. Produces bite-sized TDD tasks with exact file paths, code and commands for an engineer with zero context.","MIT","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwriting-plans\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwriting-plans\u002FSKILL.md",[103,108],{"categoryNo":104,"categoryName":105,"taxonomyType":106,"taxonomyTypeDesc":107},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":109,"categoryName":110,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[114,115,116,84,117,118,34,119,33,120,121,122,123,124,125,126,127,128,23,129],"writing","writing plans","plans","superpowers","implementation plan","you","code","tasks","plan","product","write","commands","paths","suggest","coding","ZeRO",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":134,"sourceHtmlUrl":135,"categories":136,"keywords":140,"publishedAt":94},"01M71PAXFM488X9ARXK0T04TF5","write-spec","Write a feature spec or PRD from a problem statement or feature idea. Use when turning a vague idea or user request into a structured document, scoping a feature with goals and non-goals, defining success metrics and acceptance criteria, or breaking a big ask into a phased spec.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwrite-spec\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwrite-spec\u002FSKILL.md",[137],{"categoryNo":138,"categoryName":139,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000031","产品经理",[124,141,142,143,144,86,145,34,146,147,148,123,149,150,151,152,153,154,155,156],"write spec","spec","user request","problem","acceptance","ask","vague","work","request","scoping","idea","metrics","feature","problem statement","use","document",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":161,"sourceHtmlUrl":162,"categories":163,"keywords":167,"publishedAt":94},"01M71PASSZY800C0RPEARBS918","write-query","Write optimized SQL for your dialect with best practices. Use when translating a natural-language data need into SQL, building a multi-CTE query with joins and aggregations, optimizing a query against a large partitioned table, or getting dialect-specific syntax for Snowflake, BigQuery, Postgres, etc.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwrite-query\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fwrite-query\u002FSKILL.md",[164],{"categoryNo":165,"categoryName":166,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000033","数据分析师",[33,124,168,169,170,171,86,155,34,172,173,174,175,148,176,177,178,179,180,181],"write query","postgres","for","snowflake","best practices","natural-language","with","multi","github","sql","https","syntax","plugins","data",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":194,"publishedAt":94},"01M71PAPTX0T3PF6ETFVR96SJJ","workflow-automation","Org role guidance for workflow automation: build and maintain CI\u002FCD definitions in GitHub Actions or equivalent: triggers, jobs, matrices, caching. Covers path filters, dependency caching, parallel jobs, timeouts and fail-fast ordering.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fworkflow-automation\u002FSKILL.md",[188,191],{"categoryNo":189,"categoryName":190,"taxonomyType":106,"taxonomyTypeDesc":107},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":192,"categoryName":193,"taxonomyType":106,"taxonomyTypeDesc":107},"01JBSEEDCAT000000000000023","Skill与智能体开发",[195,196,197,198,170,199,200,201,202,35,203,204,205,33,30,176,206,207,208,178],"Workflow Automation","automation","workflow","parallel","actions","ci","triggers","github actions","maintain","filters","caching","build","dependency","devops",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":94},"01M71PAM19Z1XTV9NPCFSE2MY8","workflow-architect","Org role guidance for a workflow architect: map full workflow trees for systems, user journeys and agents, covering every branch and failure. Covers discovering workflows from code, handoff contracts, timeouts, recovery paths and observable state.","https:\u002F\u002Fgithub.com\u002Fmonoes\u002Fmonomind\u002Fblob\u002Fmain\u002Fpackages\u002F@monomind\u002Fcli\u002Forg-skills\u002Fworkflow-architect\u002FSKILL.md",[215],{"categoryNo":192,"categoryName":193,"taxonomyType":106,"taxonomyTypeDesc":107},[197,217,18,218,219,220,44,170,221,222,120,32,223,224,30,176,225,226,178,227],"workflow architect","trees","user journeys","branch","map","workflows","state","leadership","recovery","operations","systems"]