skills.rest
andrewvaughan
andrewvaughanCOMMUNITY
Explore all skills by this author →
GitHub

security-audit

Run SAST, STRIDE, and attack-tree analysis to produce prioritized audit reports.

12|4|Updated Feb 9, 2026
Search Tags:#security#audit#STRIDE#threat-modeling#SAST#attack-trees
One-click install
npx skills add https://github.com/andrewvaughan/agent-council --skill security-audit-andrewvaughan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/andrewvaughan/agent-council/tree/main/canonical/skills/security-audit
Command: npx skills add https://github.com/andrewvaughan/agent-council --skill security-audit-andrewvaughan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Consolidates automated SAST scanning, threat modeling, and attack-tree analysis into a single, repeatable security audit workflow to identify and remediate risks before releases.

Core Features & Use Cases

  • Automated SAST Scanning: Detects common vulnerabilities in codebases across languages.
  • STRIDE Threat Modeling: Systematically evaluates spoofing, tampering, information disclosure, etc., to surface design-level risks.
  • Attack Tree Analysis: Builds structured paths to security goals to prioritize mitigations and evidence-based fixes.
  • Audit Reporting & Remediation: Generates prioritized findings with actionable remediation steps for developers, security engineers, and stakeholders.
  • Use Case: Pre-release security hardening, security-sensitive feature changes, or periodic compliance reviews.

Quick Start

Define the audit scope and trigger, then run the combined SAST/STRIDE/attack-tree workflow to generate the remediation plan.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on a codebase before a release?▼

A security audit identifies risks through automated SAST scanning, STRIDE threat modeling, and attack-tree analysis, producing a prioritized report with actionable remediation steps for developers and stakeholders.

What does STRIDE threat modeling evaluate during a codebase audit?▼

STRIDE threat modeling systematically evaluates spoofing, tampering, information disclosure, repudiation, and elevation of privilege to surface design-level security risks across the audited modules.

Can I scope a security audit to specific modules instead of a full repository?▼

Yes, you can apply the SAST, STRIDE, and attack-tree analysis to full repositories, specific modules, or release baselines to scope the security audit and generate targeted remediation findings.

How does attack tree analysis prioritize security mitigations?▼

Attack tree analysis builds structured paths to security goals, mapping potential exploit routes to prioritize mitigations and provide evidence-based fixes within the audit report.

What is the best way to combine SAST scanning with threat modeling for security reviews?▼

Combine automated SAST scanning with STRIDE and attack-tree analysis in a single repeatable workflow to detect common vulnerabilities and surface design-level risks for pre-release compliance reviews.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
rakhnianskii9rakhnianskii9

security-audit

Audit game codebases for security vulnerabilities and generate prioritized remediation reports.

Community
Advanced
rnavarychrnavarych
14

role-aqa:security-testing

Your response is missing. Please try again.

Community
Advanced
xijunwwxijunww
1

recon

Automate penetration testing reconnaissance to discover assets and attack surfaces.

Community
Advanced