skills.rest
badowhp
badowhpCOMMUNITY
Explore all skills by this author →
GitHub

security-engineer

Identify exploitable security risks in applications, cloud infrastructure, and CI/CD pipelines.

Updated Apr 27, 2026
Search Tags:#security#threat-modeling#incident-response#cloud-security#vulnerability-triage#authz-audit#secure-release
One-click install
npx skills add https://github.com/badowhp/skill-mania --skill security-engineer-badowhp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-engineer
Source: https://github.com/badowhp/skill-mania/tree/main/plugins/skill-mania/skills/security-engineer
Command: npx skills add https://github.com/badowhp/skill-mania --skill security-engineer-badowhp

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve?

This Skill eliminates gaps in security review processes where assessments are either too theoretical to catch realistic exploitable risks, or too ad-hoc to provide actionable, validated remediation steps for applications, cloud infrastructure, and CI/CD systems.

Core Features & Use Cases

  • Threat Modeling: Map assets, trust boundaries, actors, and abuse cases to identify realistic attack paths and prioritized mitigations.
  • Vulnerability Triage: Prioritize CVEs and scanner findings by actual reachability and exploitability rather than generic CVSS scores.
  • Secure Review: Audit authentication, authorization, secrets handling, cloud/CI exposure, and web application security controls with clear validation steps for each fix.
  • Use Case: For example, use this Skill to review a new invoice download endpoint for IDOR risks, or validate that a CI/CD pipeline does not leak production secrets to forked pull requests.

Quick Start

Use the security-engineer skill to review the latest pull request for realistic exploitable security risks and provide prioritized remediation steps with validation tests.

Frequently Asked Questions about security-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform threat modeling for cloud infrastructure and CI/CD pipelines?▼

Threat modeling for cloud infrastructure maps assets, trust boundaries, actors, and abuse cases to identify realistic attack paths. It delivers prioritized mitigations and validation steps tailored to your application and deployment architecture.

How do I triage vulnerability scanner findings by actual exploitability instead of CVSS scores?▼

Vulnerability triage prioritizes CVEs and scanner findings by analyzing actual reachability and exploitability within your environment. This contextualizes generic scores to focus remediation on risks posing realistic threats to your applications.

What is the best way to audit authentication and authorization controls for IDOR risks?▼

Auditing authentication and authorization controls reviews access mechanisms to detect IDOR risks and design flaws. It evaluates secrets handling and provides clear validation steps to verify each identified security gap is properly resolved.

Can I use this to validate that a CI/CD pipeline does not leak production secrets to forked pull requests?▼

Yes, you can validate CI/CD pipeline exposure to ensure production secrets remain isolated from forked pull requests. It audits secrets handling and pipeline configurations to prevent unauthorized access or leakage during automated builds.

How do I review a new application endpoint for realistic exploitable security risks?▼

Reviewing a new endpoint for exploitable risks involves evidence-based assessment of web application security controls and design logic. It identifies practical attack vectors like IDOR and delivers prioritized remediation recommendations with validation tests.

Does this approach provide production release readiness sign-off for security-sensitive changes?▼

Yes, it provides production release readiness sign-off for security-sensitive changes by verifying applied fixes. It ensures authentication, authorization, and secrets handling checks are validated before deployment, confirming the system is safe for release.

Related Skills

Explore More Software Engineering Skills→
StrategicMilkStrategicMilk

Infrastructure Research

Analyze infrastructure configurations and produce a structured report with prioritized recommendations.

Community
Intermediate
zerobias-orgzerobias-org

production-checklist

Automates production-readiness validation for module releases via a sign-off checklist.

Official
Advanced
bcwgamesbcwgames

security_scan

Run dependency, static code, and dataflow security scans in parallel and summarize findings.

Community
Intermediate
harperaaharperaa
15

injection-vulnerabilities-ai-generated-code

Detect SQL injection and command injection vulnerabilities in AI-generated Python code.

Community
Basic