skills.rest
rhorba
rhorbaCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-engineer

Reviews application and infrastructure security through threat modeling, auth design, and OWASP checklists.

Updated Aug 20, 2026
Search Tags:#authorization#authentication#owasp#vulnerability assessment#threat modeling#security review#incident response
One-click install
npx skills add https://github.com/rhorba/RestoLedger --skill security-engineer-rhorba
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-engineer
Source: https://github.com/rhorba/RestoLedger/tree/main/skills/security-engineer
Command: npx skills add https://github.com/rhorba/RestoLedger --skill security-engineer-rhorba

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Designing and reviewing security for applications and infrastructure is complex, and teams often either skip it or over-engineer controls that don't match their actual risk. This Skill provides structured, stage-appropriate security guidance so you can threat-model, review, and harden systems without guesswork. ## Core Features & Use Cases - Threat Modeling: Run a 5-minute threat model or a full STRIDE analysis with ready-made templates and risk tables. - Auth Design: Follow decision trees and checklists for authentication (sessions vs JWT, MFA, password policies) and authorization (RBAC, ABAC, ReBAC). - Security Reviews & Incident Response: Apply OWASP Top 10 checklists, HTTP security header configs, adversarial review prompts, and a 6-step incident response template. - Use Case: Before launching a new payments feature, ask for a security review to get an OWASP-based checklist covering access control, injection, cryptographic failures, and a verdict on whether the feature passes. ## Quick Start Ask the AI to perform a security review of your authentication flow using the OWASP checklist and threat modeling templates.

Frequently Asked Questions about security-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model for my application?▼

Start with the 5-minute threat model: define what you're building, identify likely attackers and worst outcomes, map controls to each threat, and plan validation. For more rigor, use the STRIDE template covering spoofing, tampering, repudiation, information disclosure, DoS, and privilege escalation.

Should I use sessions or JWT for authentication?▼

Use sessions for single-server apps since they're simpler to manage and revoke. Use JWT with RS256/ES256 signing for distributed systems, keeping access tokens under 15 minutes and refresh tokens under 7 days, and validate all claims server-side.

What is the difference between RBAC, ABAC, and ReBAC authorization?▼

RBAC assigns permissions to roles and suits medium apps with defined roles. ABAC uses attribute-based rules for complex dynamic conditions. ReBAC models relationships between entities, fitting social or collaborative apps. Pick the simplest pattern covering your actual needs.

What HTTP security headers should I set in production?▼

Set Strict-Transport-Security with a one-year max-age, Content-Security-Policy restricting scripts to self, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a restrictive Permissions-Policy disabling geolocation, camera, and microphone.

When should I not apply enterprise-grade security controls?▼

Match controls to actual risk and stage. A solo MVP needs only HTTPS, authentication, input validation, and secrets management. Add rate limiting, RBAC, and logging as you grow; reserve WAF, penetration testing, and compliance programs for production at scale.

Related Skills

Explore More Software Engineering Skills→
utkusenutkusen
1.3k

sast-analysis

Map codebase architecture and technology stack into sast/architecture.md.

Community
Intermediate
nksethnkseth

security-reviewer

Identify security vulnerabilities in code and infrastructure and deliver prioritized audit reports with remediation guidance.

Community
Advanced
eduardo-sleduardo-sl
64

go-dependency-audit

Audit Go module dependencies for outdated packages and known vulnerabilities.

Community
Intermediate
vertivolatamvertivolatam
1

Security & Compliance Automation

Automate security and compliance checks for cloud-native environments using OPA, Trivy, and boto3.

Official
Advanced