skills.rest
CODE-SAURABH
CODE-SAURABHCOMMUNITY
Explore all skills by this author →
GitHub

security-engineer

Identify and mitigate application and infrastructure security vulnerabilities before deployment.

2|1|Updated Jul 25, 2026
Search Tags:#oauth#jwt#owasp#threat modeling#rbac#application security#secret scanning
One-click install
npx skills add https://github.com/CODE-SAURABH/OpenSkills --skill security-engineer-code-saurabh
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-engineer
Source: https://github.com/CODE-SAURABH/OpenSkills/tree/main/security-engineer
Command: npx skills add https://github.com/CODE-SAURABH/OpenSkills --skill security-engineer-code-saurabh

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and prevent common application and infrastructure security vulnerabilities before they become breaches, including access control failures, injection, authentication weaknesses, SSRF, insecure configuration, and exposed secrets.

Core Features & Use Cases

  • Threat Modeling: Analyze assets, actors, attack surfaces, trust boundaries, and breach impact using STRIDE.
  • Security Control Reviews: Apply practical defenses for OWASP Top 10 risks, JWT, OAuth 2.0, RBAC, XSS, CSRF, security headers, dependency integrity, logging, and secret management.
  • Secret Scanning: Run a local, read-only heuristic scan to identify likely private keys, cloud access keys, and hardcoded credentials for manual confirmation.
  • Use Case: Review a new API or authentication flow, identify exploitable weaknesses, recommend prioritized mitigations, and verify completion against a security-focused definition of done.

Quick Start

Use the security-engineer skill to threat-model this feature, review its authentication and authorization controls, identify OWASP Top 10 risks, and provide prioritized remediation steps.

Frequently Asked Questions about security-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify and mitigate OWASP Top 10 vulnerabilities in my application?▼

To mitigate OWASP Top 10 vulnerabilities, review authentication, enforce deny-by-default RBAC access controls, validate inputs, and apply secure cryptography to harden application components before deployment.

What is the best way to threat model an API using STRIDE?▼

Threat modeling an API using STRIDE involves analyzing assets, actors, attack surfaces, and trust boundaries to evaluate breach impact and identify exploitable security weaknesses in the authentication flow.

How do I scan my codebase for hardcoded credentials and exposed secrets?▼

Scanning for exposed secrets requires running a local, read-only heuristic scan to identify likely private keys and cloud access keys, followed by manual confirmation of the findings to eliminate false positives.

Can I use this approach to review JWT and OAuth 2.0 authentication flows?▼

Yes, you can review JWT and OAuth 2.0 authentication flows by identifying exploitable weaknesses, verifying secure token configuration, and recommending prioritized mitigations against access control failures.

What security headers and configurations are needed to prevent XSS and CSRF attacks?▼

Preventing XSS and CSRF attacks requires hardened configurations, validated inputs, and implementing appropriate security headers to ensure deny-by-default access controls and protect application integrity.

What are the limitations of heuristic secret scanning?▼

Heuristic secret scanning is limited by potential false positives, requiring manual confirmation of findings to accurately verify detected private keys, hardcoded credentials, and cloud access keys.

Related Skills

Explore More Software Engineering Skills→
abranjithabranjith

review-security

Identify security vulnerabilities in code and deployment configuration.

Community
Advanced
adobeadobe

security-hardening

Audit Dispatcher Apache HTTP Server configs and headers for AEMaaCS security hardening.

Official
Advanced
AnvinX1AnvinX1

vulnerability-scanner

Scan codebases for dependency risks, secret leakage, and insecure configurations.

Community
Advanced
RightNow-AIRightNow-AI
18.1k

security-audit

Audit application code for OWASP Top 10 vulnerabilities and CVEs.

Official
Advanced