Skill UI

Security-first development practices for web applications. Covers threat modeling with STRIDE, OWASP Top Ten defenses, input validation, parameterized queries, authentication and session hardening, security headers, dependency auditing, and supply-chain risk assessment.

Conducts STRIDE-A threat modeling on repositories or systems, running either a full single-pass analysis with architectures, DFDs, prioritized findings, and executive assessments, or an incremental update that compares a baseline report to the current code and highlights deltas.

This framework enforces high output quality, intellectual honesty, and continuous improvement across all AppSec agents. It mandates structured processes, including self-critique loops, anti-rationalization guards, and self-reflection quality gates (≥8 scoring). Applicable during code review, SAST, SCA, and threat modeling, it ensures rigorous and verifiable security analysis.

A risk-paranoid interrogation tool designed to proactively vet any technical plan that handles sensitive data, affects compliance scope, or touches production access. It forces a comprehensive review across threat modeling, blast radius quantification, detection capabilities, incident response planning, regulatory compliance, and vendor security.

A comprehensive audit worker that integrates Open Infrastructure Architecture (OIA) manifest analysis, threat modeling, and MCP security scanning. It computes a composite worst-case severity score and persists time-stamped audit records in a memory namespace. Primarily designed for scheduled CI/CD pipelines to detect architectural drift and security regressions over time.

A comprehensive tool for authors targeting the ACM Asia Conference on Computer and Communications Security (ASIACCS). It provides expert guidance on assessing whether a computer and communications security manuscript is a strong fit for this specific, high-impact venue. Topics covered include conference fit assessment, evidence bar establishment, manuscript re-framing strategies, threat modeling, and proper community positioning for maximum review impact.

This comprehensive guide helps authors strategically position their computer security manuscripts for the ACM Conference on Computer and Communications Security (CCS). It details topic fit, required threat modeling, evidence presentation, and critical comparisons with sister venues (e.g., S&P, USENIX Security). It serves as a high-level 'fit/framing' tool for maximizing submission success in core areas like privacy, cryptography, and systems security.

A comprehensive strategic guide for authors targeting the IEEE Symposium on Security and Privacy (S&P). This skill helps evaluate if a computer science manuscript is a proper fit for the venue by covering rigorous threat modeling, ethical considerations, evidence requirements, and how to strategically frame the contribution. Use this when determining conference submission strategy or refining security-focused academic research.

This skill generates fully valid Microsoft Threat Modeling Tool (.tm7) files. It translates complex system architectures, including components, data stores, data flows, and external actors, into the required WCF DataContractSerializer XML format. Use it for structured STRIDE threat modeling outputs compatible with Microsoft's official tool.

A comprehensive white-box security auditing workflow designed for proprietary source code. It integrates static analysis security testing (SAST) tools like Semgrep and CodeQL to detect common vulnerabilities (e.g., injection, IDOR, crypto misuse), followed by mandatory manual threat modeling and verification steps. Applicable for PR reviews and pre-deployment security checks.

This advanced skill performs server-enforced security and privacy reviews for applications, including those rapidly developed with AI agents. It implements comprehensive models like STRIDE (security) and LINDDUN (privacy), screens dependencies against live CVE/CISA data, and evaluates applicability of major EU regulations (GDPR, AI Act, NIS2). The output is a formal, auditable compliance report, never a simulated chat response or legal verdict.