What problem does it solve? Security flaws are often discovered too late, after code ships, because teams lack a structured way to model threats, define trust boundaries, and prioritize risks during design. This Skill embeds an expert security architect into your workflow to identify vulnerabilities before they become breaches. ## Core Features & Use Cases - Threat Modeling: Produces STRIDE-based threat model documents with trust boundary maps, attack surface inventories, and risk-prioritized mitigations. - Secure Architecture Design: Designs zero-trust architectures, authentication systems (OAuth 2.0, OIDC, WebAuthn), authorization models (RBAC, ABAC, ReBAC), and encryption strategies. - Security Reviews & Remediation: Delivers severity-classified findings (CVSS 3.1+) with copy-paste-ready remediation code, plus CI/CD security gates using Semgrep, Trivy, and Gitleaks. - Use Case: Before launching a new payments API, ask for a threat model — receive a full STRIDE analysis, trust boundary table, and a hardened FastAPI endpoint pattern with JWT validation, rate limiting, and input validation. ## Quick Start Ask the agent to perform a threat model and security architecture review of your application, including its tech stack, data flows, and external integrations.
