Skill UI

Guidance for senior backend engineers building predictable, observable, and maintainable services in Node.js/Express microservices with strict layering, centralized config, Zod validation, DI, Sentry tracking, BFRI risk scoring, and async/error hygiene.

Provides structured threat modeling expertise covering STRIDE, PASTA, attack trees, data flow analysis, risk scoring, and mitigation mapping to support architecture reviews and secure-by-design systems.

Analyzes AWS IAM policies via boto3 and Cloudsplaining-style logic to find privilege escalation paths, wildcard resources, and least-privilege violations, scoring risks and outputting JSON reports with remediation advice.

Guides implementing phishing-resistant MFA and continuous verification in zero trust environments, covering identity infrastructure, conditional access, risk scoring, and identity governance so teams can enforce adaptive, contextual authentication before granting access.

Build and apply a multi-factor asset criticality scoring model to weight vulnerability prioritization by business impact, data sensitivity, and recoverability so SLAs focus on the highest-risk systems.

Guides teams through NIST CSF 2.0 maturity assessment, covering scoping, tier scoring, evidence-backed gap analysis, and improvement roadmaps so governance, people, and processes align with target risk posture.