security-auditor

A security audit of specifications identifies gaps in threat modeling, authentication, authorization, data protection, and input validation. This skill automates the review process using OWASP ASVS v4 and CWE references to generate a Security Posture Scorecard with actionable findings.

A threat-driven security audit covers threat modeling, authentication, authorization, data handling, incident response, regulatory compliance, and security testing. It checks specifications against OWASP ASVS v4 and CWE standards to identify gaps and generate traceability artifacts.

To generate a Security Posture Scorecard, run an automated security audit on your specification set. The scorecard evaluates 10 security dimensions and outputs structured findings with CWE references and mitigation questions, applicable across specification repositories and development pipelines.

Yes, this security audit validates specifications against OWASP ASVS v4, CWE references, and SWEBOK v4 alignment. It surfaces security findings related to threat modeling, data handling, and regulatory compliance by leveraging these established security frameworks.

Yes, this specification audit identifies missing input validation, weak cryptography, incomplete authentication specifications, and unprotected data. It surfaces these security findings through an automated review process and outputs structured mitigation questions without proposing implementations.

The limitation of this automated security audit is that it identifies gaps and produces mitigation questions without proposing specific implementations. It focuses on surfacing missing security controls and generating traceability artifacts rather than writing code or fixing vulnerabilities directly.