skills.rest
JamSuite
JamSuiteOFFICIAL
Explore all skills by this author →
GitHub

sec

Analyze specs and project files for STRIDE and LINDDUN security findings.

1|1|Updated Feb 25, 2025
Search Tags:#architecture#threat-modeling#stride#security-analysis#spec-review#linddun
One-click install
npx skills add https://github.com/JamSuite/jim --skill sec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sec
Source: https://github.com/JamSuite/jim/tree/main/skills/sec
Command: npx skills add https://github.com/JamSuite/jim --skill sec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Perform design-time security analyses of specs, plans, or arbitrary project files, surfacing actionable findings to guide secure design decisions and reduce risk early in the SDLC.

Core Features & Use Cases

  • Hybrid expert review paired with a STRIDE completeness sweep; LINDDUN is applied when data classification flags PII, credentials, or session data.
  • Spec-scoped mode produces a security.md artifact alongside other spec artifacts; ad-hoc mode delivers findings in conversation with optional file output.
  • Integrates with /jim:plan and /jim:build phase gates to validate security considerations during planning and execution.

Quick Start

Run /jim:sec on a target directory containing spec.md to initiate a design-time security review.

Frequently Asked Questions about sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform threat modeling on a spec document before implementation?▼

A STRIDE sweep systematically identifies spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege threats across spec components. It is enforced during design-time security reviews to ensure completeness before implementation begins.

When do I need to apply LINDDUN privacy analysis during security reviews?▼

Spec-scoped security analysis produces a structured security.md artifact alongside other spec artifacts, integrating findings directly into the specification. Ad-hoc mode delivers findings in conversation with optional file output for arbitrary project files without a full spec context.

How can I integrate security analysis into planning and build phase gates?▼

Security analysis operates in spec-scoped mode requiring a target directory containing spec.md to generate a security.md artifact. Alternatively, ad-hoc mode accepts arbitrary project files and delivers findings directly in conversation with optional file output.

What is the difference between spec-scoped and ad-hoc security analysis modes?▼

Security analysis targets architecture and design-level vulnerabilities in specs and plans before code execution. It focuses on data classification, STRIDE threat categories, and conditional LINDDUN privacy analysis to surface actionable security findings early.

Related Skills

Explore More Software Engineering Skills→
CsHengCsHeng
10

config-sync-overview

Summarize config-sync phase pipelines, backup strategies, and .claude directory semantics.

Community
Basic
pontschopontscho
1

p:security-review

Automate security audits of code and plan artifacts with structured findings.

Community
Advanced
Sn005Sn005
1

pr

Automate pull request creation for specifications and implementations with enforced templates.

Community
Advanced
dobrinz123dobrinz123

gsd-secure-phase

Audit phase threat mitigations and update SECURITY.md with verified controls.

Community
Advanced