secure-sdlc

Manage security workflows with threat modeling templates and pre-merge review checklists.

Updated Apr 3, 2026

Search Tags:#security #threat modeling #incident response #security requirements #secure development lifecycle

Ready to run

npx skills add https://github.com/kirvin/agent-dev-harness --skill secure-sdlc-kirvin

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secure-sdlc
Source: https://github.com/kirvin/agent-dev-harness/tree/main/plugins/kf/skills/secure-sdlc
Command: npx skills add https://github.com/kirvin/agent-dev-harness --skill secure-sdlc-kirvin

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

The secure-sdlc Skill addresses the complexities of security within a development stack, offering references and playbooks to guide threat modeling, security requirement specifications, and incident responses.

Core Features & Use Cases

Security Reference Library: Provides a comprehensive collection of security best practices, including STRIDE threat modeling and EARS security invariants.
Pre-Merge Security Review: Ensures security-sensitive PRs are reviewed against a predefined checklist to prevent security vulnerabilities.
Incident Response Playbooks: Offers step-by-step guidelines for handling common credential exposure scenarios in the stack.

Quick Start

Load the 'secure-sdlc' skill and use it to access the appropriate reference or playbook based on your current security task.

Frequently Asked Questions about secure-sdlc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform threat modeling for a Node.js and TypeScript project?▼

Threat modeling for Node.js and TypeScript projects uses STRIDE templates and EARS security invariants provided by this Skill to identify threats and define security requirements.

How do I enforce a pre-merge security review checklist for GitHub Actions PRs?▼

Pre-merge security review for GitHub Actions PRs is enforced by evaluating security-sensitive pull requests against a predefined checklist to prevent vulnerabilities before merging.

What is the best way to create an incident response playbook for exposed AWS Bedrock credentials?▼

Incident response playbooks for exposed AWS Bedrock credentials provide step-by-step guidelines for handling common credential exposure scenarios within the development stack.

Can I use secure development lifecycle practices with Figma API and Beads issue tracking?▼

Yes, secure development lifecycle practices are tailored for Figma API and Beads issue tracking, providing specific references and playbooks for these platforms.

What security requirements should I check before merging infrastructure code?▼

Security requirements for infrastructure code are checked using specialized checklists covering threat modeling and security invariants to prevent vulnerabilities before deployment.