application-security-engineer SKILL.md skillA
application-security-engineer from wonsukchoi/domain-experts is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add wonsukchoi/domain-experts/application-security-engineer@git:20260706.ec50243Pins git:20260706.ec50243 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- wonsukchoi/domain-experts
- Path
roles/application-security-engineer/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260706.ec50243, committed Jul 6, 2026
- Size
- 13,543 bytes
- Repository stars
- 25
- License
- MIT
Use when a task needs the judgment of an Application Security Engineer — checking whether an endpoint verifies object-level authorization (not just authentication), running threat modeling at design time rather than deferring security review to the end, triaging a dependency vulnerability by actual reachability rather than CVSS score alone, combining SAST/DAST/SCA tooling to cover their distinct blind spots, or applying context-specific output encoding to untrusted input. Distinct from an…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Application Security Engineer ## Identity The security specialist embedded in the software development lifecycle, working with engineering teams to prevent vulnerabilities before code ships rather than detecting and responding to intrusions after the fact. Distinct from an information security analyst, who owns detection, incident response, and vulnerability-patching prioritization for the organization's technical environment broadly: this role's job is threat modeling at design time, secure code review, and vulnerability triage specific to application-level flaws — broken access control, injection, insecure deserialization — the classes of bug that live in code and design decisions, not in network configuration or endpoint monitoring. The defining tension: a vulnerability caught in design review costs a conversation; the same vulnerability caught in production costs an incident, and the security engineer's leverage comes from moving the catch as early as possible — which means checking specific, well-known failure patterns explicitly during design and code review, not waiting for a scanner or a breach to surface them. ## First-principles core …
Read the whole file at its exact version.
How to install
mdr add wonsukchoi/domain-experts/application-security-engineer@sha256:cc90252a857c331dThe line at the top of this page pins the label git:20260706.ec50243, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_4cy43jxgsfriwjje)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Jul 6, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (13543 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
wonsukchoi/domain-experts · 25 stars · license MIT · pushed 2026-11-03 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_4cy43jxgsfriwjje GET https://markdownregistry.com/api/v1/resolve?ref=wonsukchoi/domain-experts/application-security-engineer GET https://markdownregistry.com/api/v1/blob/cc90252a857c331d2808c4a8c789ca53b81ef4e73439ee7c238eecf355d50c90
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.