skills.rest
tcvdog
tcvdogCOMMUNITY
Explore all skills by this author →
GitHub

Security Engineer

Reviews application code and infrastructure for vulnerabilities and produces threat models with remediation guidance.

2|Updated May 21, 2026
Search Tags:#code review#OWASP#security#vulnerability assessment#threat modeling#DevSecOps#cloud security
One-click install
npx skills add https://github.com/tcvdog/agency-agents-hermes --skill security-engineer-tcvdog
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Security Engineer
Source: https://github.com/tcvdog/agency-agents-hermes/tree/main/engineering/security-engineer
Command: npx skills add https://github.com/tcvdog/agency-agents-hermes --skill security-engineer-tcvdog

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web, API, and cloud-native applications ship with preventable vulnerabilities like injection flaws, broken access control, and leaked secrets. This Skill embeds an application security engineer into your workflow to find risks early, classify them by severity, and deliver concrete fixes. ## Core Features & Use Cases - Threat Modeling: Maps architecture, trust boundaries, and data flows, then runs STRIDE analysis to prioritize risks before code is written. - Secure Code Review & Vulnerability Assessment: Audits code against OWASP Top 10 and CWE Top 25, covering SQLi, XSS, SSRF, IDOR, authentication flaws, and business logic abuse, with CVSS-based severity ratings. - Security Architecture & CI/CD Gates: Designs zero-trust controls, OAuth 2.0/OIDC authentication, secrets management, and pipelines with SAST, SCA, and secrets detection. - Use Case: Before launching a new FastAPI service, ask for a security review to receive a threat model document, a prioritized findings report with copy-paste-ready remediation code, and a GitHub Actions security scanning workflow. ## Quick Start Ask the agent to perform a security review and threat model of your application codebase, including authentication, input validation, and dependency auditing.

Frequently Asked Questions about Security Engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security code review on a web application?▼

Walk through authentication, authorization, input handling, data access, and error handling against the OWASP Top 10 and CWE Top 25. Classify each finding by CVSS severity and pair it with concrete remediation code.

How to create a threat model for a microservices application?▼

Map the architecture, data flows, and trust boundaries, then run a STRIDE analysis covering spoofing, tampering, repudiation, information disclosure, DoS, and privilege escalation per component. Prioritize risks by combining exploit likelihood with business impact.

What security scans should run in a CI/CD pipeline?▼

Integrate SAST with Semgrep, dependency auditing with Trivy, and secrets detection with Gitleaks as pull request gates. Configure scans to fail the build on critical and high severity findings.

Does this cover API security testing like BOLA and IDOR?▼

Yes, the assessment covers broken authentication, BOLA, BFLA, excessive data exposure, rate limiting bypass, GraphQL introspection attacks, and WebSocket hijacking. It also tests horizontal and vertical privilege escalation through role boundary checks.

Can it review cloud and Kubernetes security configurations?▼

Yes, it evaluates IAM over-privilege, public storage buckets, network segmentation, Pod Security Standards, NetworkPolicies, RBAC, and container hardening like non-root execution and read-only filesystems. It also reviews Terraform and CloudFormation templates.

What are the limitations of automated security review?▼

Automated review focuses on defensive assessment and known vulnerability classes, so novel business logic flaws may need manual penetration testing. It provides remediation guidance but does not replace a full red team engagement for high-stakes systems.

Related Skills

Explore More Software Engineering Skills→
cvenwucvenwu

architecture-diagram

Generate architecture diagrams as self-contained HTML+SVG files.

Community
Intermediate
yckkkkyckkkk
1

cso

Audit code, dependencies, CI/CD pipelines, and AI interactions for security gaps.

Community
Advanced
johngutierrez31johngutierrez31

cybersecurity-analyst

Analyze security events using threat modeling and zero-trust frameworks.

Community
Advanced
ripgraphicsripgraphics

mode-pentest

Executes a structured penetration testing workflow from reconnaissance to reporting.

Community
Advanced