skills.rest
UnitOneAI
UnitOneAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

appsec-engineer

Guide application security engineers through threat modeling and secure code review.

44|128|Updated Mar 6, 2026
Search Tags:#owasp#threat modeling#prompt injection#application security#api security#llm security#secure code review
One-click install
npx skills add https://github.com/UnitOneAI/SecuritySkills --skill appsec-engineer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: appsec-engineer
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/roles/appsec-engineer
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill appsec-engineer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It turns application security work into a repeatable, framework-referenced process that helps engineers produce consistent, auditable findings instead of ad-hoc or hallucinated guidance.

Core Features & Use Cases

  • Application-layer engagement bundles for design-time threat modeling, PR-focused secure code review, API security assessment, and AI/LLM feature security evaluation.
  • Framework-grounded outputs mapped to OWASP Top 10, OWASP ASVS 4.0.3, OWASP API Security Top 10 (2023), and OWASP Top 10 for LLM Applications.
  • Injection-hardened guidance and safe sequencing that keeps threat modeling, validation, and remediation structured across engagement types.
  • Use cases: starting a new service, reviewing security-sensitive pull requests, assessing external API exposure, and evaluating LLM/agent features for prompt injection and unsafe agency.

Quick Start

Invoke the appsec-engineer role bundle to run a new application security review sequence by providing your application description, trust boundaries, and current API/code context.

Frequently Asked Questions about appsec-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform threat modeling for a new service using OWASP standards?▼

Secure code review for security-sensitive pull requests targets injection flaws and authorization weaknesses mapped to OWASP Top 10 families. It treats LLM outputs as untrusted and prioritizes validation-focused remediation guidance.

How do I assess API security exposure against the OWASP API Security Top 10?▼

API security assessment evaluates externally exposed APIs against the OWASP API Security Top 10 (2023) to identify authorization and validation vulnerabilities. The process requires current API context to generate injection-hardened, framework-referenced findings.

Can I use this to evaluate LLM application features for prompt injection risks?▼

Running application security reviews requires framework alignment to OWASP standards and providing application descriptions, trust boundaries, and current API or code context. No specific dependencies are needed to start the engagement sequence.

What is the best way to structure secure code review for security-sensitive pull requests?▼

Secure code review for security-sensitive pull requests targets injection flaws and authorization weaknesses mapped to OWASP Top 10 families. It treats LLM outputs as untrusted and prioritizes validation-focused remediation guidance.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
issdandavisissdandavis
6

security-auditor

Identify and remediate OWASP-aligned security vulnerabilities in codebases.

Community
Advanced
diarworlddiarworld
6

ai-factory.ci

Generate and enhance CI/CD pipelines for GitHub Actions and GitLab CI.

Community
Advanced
AnsteorraAnsteorra
6

security-audit

Perform static and dynamic security audits on the KMP application.

Official
Advanced