skills.rest
hainamchung
hainamchungCOMMUNITY
Explore all skills by this author →
GitHub

security-auditor

Assess architecture, threat models, and controls to prioritize security audit findings.

54|18|Updated Jan 21, 2026
Search Tags:#security#audit#compliance#threat-modeling#devsecops#risk-management
One-click install
npx skills add https://github.com/hainamchung/agent-assistant --skill security-auditor-hainamchung
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/hainamchung/agent-assistant/tree/main/skills/security-auditor
Command: npx skills add https://github.com/hainamchung/agent-assistant --skill security-auditor-hainamchung

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps organizations conduct rigorous security audits, validate DevSecOps controls, and ensure compliance across CI/CD pipelines and architectures.

Core Features & Use Cases

  • DevSecOps & Security Automation: security pipeline integration with SAST, DAST, IAST, and dependency scanning in CI/CD
  • Threat modeling & risk assessment: STRIDE, PASTA-based threat modeling, and risk prioritization
  • Compliance automation & reporting: policy-as-code, continuous compliance monitoring, and audit-ready documentation
  • Incident response planning: playbooks, forensics readiness, and remediation validation

Quick Start

Run a security audit against the target project and generate a prioritized remediation plan.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I conduct a security audit on my CI/CD pipeline?▼

A security audit identifies project scope and assets, assesses architecture and threat models, performs targeted scans, and outputs prioritized remediation steps for your CI/CD pipeline.

How does threat modeling with STRIDE or PASTA work for risk prioritization?▼

Threat modeling using STRIDE or PASTA identifies potential security threats against your architecture, allowing you to assess and prioritize risks based on severity before applying targeted controls.

What's the best way to generate audit-ready compliance documentation?▼

The best way to generate audit-ready compliance documentation is through continuous compliance monitoring and policy-as-code, validating existing controls and mapping them directly to your specific requirements.

Can I integrate SAST and DAST security automation into my DevSecOps workflow?▼

Yes, you can integrate SAST, DAST, IAST, and dependency scanning into your DevSecOps workflow by assessing existing pipeline controls and performing targeted security scans for high-risk areas.

How do I prioritize security findings and validate remediation fixes?▼

You prioritize security findings by severity based on threat models and targeted scan results, then validate remediation fixes by documenting residual risk and ensuring high-risk areas are resolved.

Related Skills

Explore More Legal & Compliance Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
GRCEngClubGRCEngClub
367

risk-register-manager

Manage organizational risk registers and generate board-ready risk reports.

Official
Intermediate
luokai25luokai25

devsecops-expert

Integrates security scans into CI/CD pipelines automating vulnerability detection.

Community
Advanced
mahg-esmahg-es
3

compliance

Map regulatory requirements to technical controls and automate evidence collection.

Official
Advanced