skills.rest
FernanSuoza
FernanSuozaCOMMUNITY
Explore all skills by this author →
GitHub

sec-risk-security-review

Perform OWASP ASVS-aligned threat modeling and risk assessment for proposed architectures.

Updated Mar 22, 2026
Search Tags:#risk-assessment#threat-modeling#stride#mitigation#security-review#data-classification#owasp-asvs
One-click install
npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-risk-security-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sec-risk-security-review
Source: https://github.com/FernanSuoza/AIDD-project-bootstrap/tree/main/templates/skills/sec-risk-security-review
Command: npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-risk-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provide structured threat modeling, risk scoring, and mitigation planning for architecture and proposed changes so teams can identify, prioritize, and remediate security, privacy, and compliance risks before release.

Core Features & Use Cases

  • STRIDE threat identification: Systematic threat enumeration across components and trust boundaries.
  • Risk scoring and prioritization: Likelihood × impact scoring, red/yellow/green categorization, and blocking criteria for high risks.
  • ASVS & data classification mapping: Map controls to OWASP ASVS levels and label all data (L1-L4) with handling rules.
  • Mitigation & escalation workflow: Actionable mitigations with owners/due dates and human escalation items for legal/compliance decisions.
  • Use Case: Architecture review for a payment or healthcare service requiring ASVS L2/L3 mapping, secrets inventory verification, and red-risk approvals.

Quick Start

Run the sec-risk-security-review skill with a proposed architecture description, data classification details, and any scanner findings to receive a prioritized threat model and mitigation plan.

Frequently Asked Questions about sec-risk-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform STRIDE threat modeling for a proposed architecture change?▼

STRIDE threat modeling systematically enumerates threats across components and trust boundaries. This Skill performs STRIDE analysis on proposed architectures, generating threat lists, likelihood×impact risk scores, and actionable mitigation recommendations.

Can I map security controls to OWASP ASVS levels during a risk assessment?▼

Yes, OWASP ASVS control mapping is supported during risk assessment. The Skill maps identified threats and mitigations to OWASP ASVS levels, verifying compliance requirements for services handling sensitive data, authentication, or third-party integrations.

What is the best way to prioritize security risks identified during a release review?▼

Risk prioritization uses likelihood×impact scoring with red, yellow, and green categorizations. The Skill applies blocking criteria for high risks, ensuring critical security vulnerabilities are escalated for legal or compliance approvals before release.

Does this threat modeling process support data classification and handling rules?▼

Data classification is integrated into the threat modeling process. The Skill assigns L1-L4 data classification labels with handling rules, ensuring sensitive data across architecture components receives appropriate security and privacy controls.

How do I generate mitigation recommendations and escalation items for high-risk threats?▼

Mitigation recommendations are generated with assigned owners and due dates. The Skill produces an escalation workflow for human review, routing red-risk legal and compliance decisions to appropriate stakeholders before architecture approval.

Related Skills

Explore More Legal & Compliance Skills→
pluginagentmarketplacepluginagentmarketplace
3

vulnerability-discovery

Identify and analyze AI/LLM vulnerabilities via structured threat modeling and attack surface analysis.

Community
Advanced
oalansilvaoalansilva

compliance-readiness

Identify policy gaps against required controls and generate a prioritized remediation plan.

Community
Intermediate
florianbuetowflorianbuetow
12

pasta-vulns

Scan code and dependencies for vulnerabilities mapped to CWEs.

Community
Advanced
48Nauts-Operator48Nauts-Operator
3

threat-mitigation-mapping

Map identified threats to security controls and mitigation coverage gaps.

Community
Advanced