skills.rest
jacob-balslev
jacob-balslevCOMMUNITY
Explore all skills by this author →
GitHub

security-fundamentals

Model threats and enforce trust-boundary, authentication, and input validation rules.

1|Updated May 6, 2026
Search Tags:#security#input validation#threat modeling#owasp top 10#defense in depth#trust boundaries#authn authz
One-click install
npx skills add https://github.com/jacob-balslev/skill-graph --skill security-fundamentals-jacob-balslev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-fundamentals
Source: https://github.com/jacob-balslev/skill-graph/tree/main/marketplace/skills/security-fundamentals
Command: npx skills add https://github.com/jacob-balslev/skill-graph --skill security-fundamentals-jacob-balslev

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security fundamentals helps you prevent common system-security failures by making threat modeling, trust boundaries, input validation, and authn/authz placement explicit before implementation debt accumulates.

Core Features & Use Cases

  • Threat-modeling discipline: uses Shostack’s four questions to produce verifiable mitigations and ongoing review, not one-time “security theater.”
  • Trust boundary & input validation guidance: defines where untrusted data enters, how to validate at the boundary, and how to parse into typed/validated values.
  • Authentication vs authorization clarity: enforces the rule that authentication happens at entry and authorization is checked at every privileged action.
  • Defense-in-depth framing: coordinates layered controls (identity, authz, validation, encryption, logging/monitoring, rate limiting) to limit blast radius when one layer fails.
  • OWASP Top 10 mapping for recurring classes: provides a working enumeration of vulnerability categories to guide design-time checks.

Quick Start

Ask the agent to audit a new API endpoint by listing its trust boundaries, specifying where input validation occurs, and verifying that authentication and authorization are applied exactly where privileged actions happen.

Frequently Asked Questions about security-fundamentals

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I design trust boundaries and input validation for a new API endpoint?▼

To audit an API endpoint for security, list its trust boundaries, specify where input validation occurs, and verify that authentication and authorization are applied exactly where privileged actions happen. This explicit mapping prevents common system-security failures.

What is the difference between authentication and authorization in application security?▼

Threat modeling establishes security design discipline by applying Shostack’s four questions to produce verifiable mitigations and ongoing reviews. It prevents implementation debt by making trust boundaries, input validation, and authn/authz placement explicit before coding.

How does defense in depth limit blast radius when one security layer fails?▼

Defense in depth limits blast radius by coordinating layered controls including identity, authorization, validation, encryption, logging, and rate limiting. If one layer fails, the remaining independent controls continue to protect privileged actions and untrusted data entry points.

Can I use threat modeling for inter-service calls and external callbacks?▼

Threat modeling applies to inter-service calls and external callbacks by treating them as untrusted data entry points requiring boundary validation. This ensures explicit trust-boundary handling and least-privilege decisions are applied across all application and API designs.

What security specialties are excluded when designing trust boundaries?▼

Designing trust boundaries explicitly excludes prompt-injection defenses, crypto primitive implementation, automated scanners, and compliance paperwork. The focus remains strictly on threat modeling, input validation placement, and authn/authz separation.

Related Skills

Explore More Software Engineering Skills→
ncsound919ncsound919

security-threat-model

Identify and document repository-specific threat models for defensive security.

Community
Advanced
komlukkomluk
1

security-review-checklists

Generate security review checklists covering OWASP Top 10 and STRIDE threat modeling.

Community
Intermediate
dralgorhythmdralgorhythm
111

defense-in-depth

Design and implement defense-in-depth security across five layers.

Community
Advanced
Prathmesh2000Prathmesh2000
1

security-analyst

Identify security risks and vulnerabilities in software designs and deployments.

Community
Advanced