skills.rest
PeterHdd
PeterHddCOMMUNITY
Explore all skills by this author →
Website𝕏@peterndevGitHub

engineering-security-engineer

Model threats with STRIDE and DREAD frameworks and assess OWASP Top 10 risks.

10|Updated Mar 4, 2026
Search Tags:#vulnerability assessment#threat modeling#compliance#security engineering#OWASP Top 10
One-click install
npx skills add https://github.com/PeterHdd/agent-skills --skill engineering-security-engineer-peterhdd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: engineering-security-engineer
Source: https://github.com/PeterHdd/agent-skills/tree/main/skills/engineering-security-engineer
Command: npx skills add https://github.com/PeterHdd/agent-skills --skill engineering-security-engineer-peterhdd

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python, trufflehog, gitleaks, snyk, grype, cosign, notary, trivy, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides expert-level guidance and tools for securing applications, infrastructure, and pipelines, addressing security concerns across multiple domains.

Core Features & Use Cases

  • Security Engineering Guide: Offers comprehensive guidance on application security, infrastructure hardening, threat modeling, vulnerability management, and security operations.
  • Threat Modeling and Risk Scoring: Utilizes the STRIDE and DREAD frameworks to model threats and score risks.
  • OWASP Top 10 Decision Rules: Provides decision rules for mitigating the top 10 web application security risks.
  • Secrets Management: Offers rules and tools for managing secrets securely to prevent data breaches.
  • API Security Decision Rules: Provides guidelines for secure API design and implementation.
  • Compliance Quick Reference: Includes checklists for SOC 2, GDPR, HIPAA, and PCI-DSS compliance.

Quick Start

Install the skill and use the provided scripts to scan for secrets and audit authentication surfaces in your codebase.

Frequently Asked Questions about engineering-security-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I remediate OWASP Top 10 vulnerabilities in my web application?▼

To remediate OWASP Top 10 vulnerabilities, this Skill applies decision rules for mitigating the top 10 web application security risks alongside threat modeling using STRIDE and DREAD frameworks to score and prioritize fixes.

What is the best way to scan my codebase for exposed secrets?▼

Scanning your codebase for exposed secrets is best done using the provided scripts that integrate trufflehog and gitleaks to detect hardcoded credentials and audit authentication surfaces automatically.

Can I use trivy and grype for vulnerability assessment in my CI pipeline?▼

Yes, you can use trivy and grype for vulnerability assessment as this Skill includes scripts leveraging these tools to scan dependencies and container images within your security engineering pipelines.

Do I need Python installed to run these security engineering checks?▼

Yes, you need Python installed because this comprehensive security engineering Skill requires Python alongside various security tools like snyk, cosign, and notary to execute its scripts and perform compliance checks.

How do I check my infrastructure for SOC 2 and PCI-DSS compliance?▼

To check infrastructure for SOC 2 and PCI-DSS compliance, this Skill provides a compliance quick reference containing checklists for SOC 2, GDPR, HIPAA, and PCI-DSS security frameworks.

Does this Skill provide guidelines for secure API design?▼

Yes, this Skill provides API security decision rules that offer specific guidelines for secure API design and implementation to prevent vulnerabilities in your application architecture.

Related Skills

Explore More Software Engineering Skills→
ancolemanancoleman
503

managing-vulnerabilities

Automate multi-layer security scanning and SBOM generation in CI/CD pipelines.

Community
Advanced
weirdgmeweirdgme
4

devsecops

Automate security integration across CI/CD pipelines with policy-as-code enforcement.

Community
Advanced
martinholovskymartinholovsky
45

harbor-expert

Administer Harbor container registries with Trivy scanning, RBAC, and replication.

Community
Advanced
j0KZj0KZ

security-scanner

Scan JavaScript/TypeScript codebases for OWASP Top 10 risks and secrets.

Community
Advanced