skills.rest
sundarshahi
sundarshahiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-engineer

Audits application code for OWASP vulnerabilities and executes authorized VAPT with CVSS-scored reports.

1|Updated Jun 24, 2026
Search Tags:#code review#OWASP#threat modeling#penetration testing#security audit#SBOM#vapt
One-click install
npx skills add https://github.com/sundarshahi/drydock --skill security-engineer-sundarshahi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-engineer
Source: https://github.com/sundarshahi/drydock/tree/main/skills/security-engineer
Command: npx skills add https://github.com/sundarshahi/drydock --skill security-engineer-sundarshahi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Shipping code without a systematic security review leaves applications exposed to injection, broken access control, auth flaws, data leaks, and vulnerable dependencies. This Skill performs a structured application-security audit — threat modeling, code audit, auth review, data security, and supply chain analysis — and can execute an authorized penetration test with a professional VAPT report. ## Core Features & Use Cases - STRIDE Threat Modeling: Maps attack surfaces, trust boundaries, and data-flow threats per service, and emits a machine-readable security-requirements file that build agents consume. - OWASP Code Audit: Reviews code against OWASP Top 10:2025 RC1, API Security Top 10 (2023), and LLM Top 10 (2025), with every finding tagged by CVSS, CWE, WSTG, and ASVS identifiers and file:line evidence. - Authorized VAPT Execution: Runs gated DAST and exploitation tooling (ZAP, nuclei, sqlmap, schemathesis) only after an explicit authorization gate, capturing request/response evidence and PASS/FAIL verdicts per scenario. - Use Case: After your backend and frontend are implemented and tested, run this Skill to produce a threat model, per-service findings with severity counts, a remediation plan with before/after code fixes, and a CVSS-scored pentest report. ## Quick Start Ask the security engineer to audit my API and services for the OWASP Top 10 and produce a prioritized remediation plan.

Frequently Asked Questions about security-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my code for OWASP Top 10 vulnerabilities?▼

Run the security-engineer skill after implementation and testing are complete. It evaluates all OWASP Top 10:2025 RC1 categories plus the API Security Top 10, and every finding includes a file:line location, proof of concept, and a concrete remediation.

What is the difference between a security audit and a penetration test?▼

The audit (Phases 1-6) is static analysis: threat modeling, code review, auth tracing, and dependency scanning. The penetration test (Phases 7-8) actively executes DAST tooling against a running target and only runs after an explicit authorization gate is confirmed.

Does the security audit cover LLM application vulnerabilities?▼

Yes, conditionally. When LLM/ML usage is detected via imports like openai, anthropic, or langchain, the audit evaluates the OWASP Top 10 for LLM Applications (2025), including prompt injection, sensitive information disclosure, and excessive agency.

Can the skill run penetration tests without authorization?▼

No. Phase 7 has a hard authorization gate requiring recorded written authorization, an in-scope target allowlist, and rules of engagement. Without it, only static and passive tooling (SAST, SCA, secret scanning) runs and no payload reaches a running system.

Why does the audit separate application security from infrastructure security?▼

This skill owns application-level concerns like OWASP code review, auth flows, PII handling, and dependency vulnerabilities. Infrastructure concerns such as WAF rules, IAM policies, network security groups, and container image scanning are delegated to the devops skill to avoid overlap.

What inputs are required before running a security audit?▼

The audit requires implementation code in services/ and frontend/ plus API specifications in api/; without these it stops. Architecture docs, schemas, infrastructure configs, and tests are optional but their absence reduces audit scope and is flagged in findings.

Related Skills

Explore More Software Engineering Skills→
aroidoaroido

agent-api-integrator

Generate type-safe API clients and React Query hooks from API specifications.

Official
Intermediate
ivanshamaevivanshamaev
14

infra-compliance-readiness

Map Kubernetes and cloud data platform controls to SOC2 Type II and GDPR compliance evidence.

Community
Advanced
foutoucourfoutoucour

infra-security-audit

Audit cloud infrastructure configurations for security misconfigurations and exposure.

Community
Intermediate
marquesfelipmarquesfelip

security-testing

Orchestrate SAST, DAST, and SCA workflows in CI/CD pipelines.

Community
Advanced