security · git:20260405.002addc · 2026-04-05 · sha256 bf2fe09ea7b5e1b4

security git:20260405.002addcA

Immutable. This exact content is served forever at /api/v1/blob/bf2fe09ea7b5e1b4.

---
name: security
description: Security skill for threat modeling, secure defaults, and security-focused code review in generic software projects.
---

# Security

This skill adds security-specific guidance.

## Default Stance

- prioritize realistic attacker goals and concrete impact
- ground claims in actual code, entrypoints, data flows, and deployment shape
- prefer secure defaults that do not silently break intended behavior

## Threat-Model Workflow

1. Identify components, entrypoints, trust boundaries, assets, and attacker goals.
2. Separate runtime behavior from build/test/dev tooling.
3. Enumerate a small set of high-quality abuse paths.
4. Rank findings by likelihood and impact with explicit assumptions.
5. Recommend mitigations tied to concrete boundaries or components.

## Secure-Review Workflow

When reviewing code for security:

- look for auth/authz gaps, unsafe parsing, command execution, path traversal,
  injection, secrets exposure, weak validation, and denial-of-service risks
- note where types/contracts could make misuse harder
- distinguish critical findings from hygiene improvements

## Reporting Rules

- findings first, ordered by severity
- include concrete file references and impacted asset/boundary
- make assumptions explicit
- avoid generic checklist noise when the repo evidence does not support it