Mitigate security risks in system design and development.
npx skills add https://github.com/ragnarula/cc-plugins --skill security-ragnarula
Please help me install this Agent Skill. Skill: security Source: https://github.com/ragnarula/cc-plugins/tree/main/sdd/skills/security Command: npx skills add https://github.com/ragnarula/cc-plugins --skill security-ragnarula
This skill helps engineers design and review systems with a security-first mindset by identifying trust boundaries, potential attack surfaces, and mitigation strategies.
Describe the system's trust boundaries and data flows. Identify 2–3 threat scenarios and propose mitigations. Provide a concise checklist for security requirements in design and review.
High-intent search queries and answers about installing and using this skill.
Trust boundaries define where data flows between components with different privilege levels. Map your system's data flows, identify where external input enters, and mark transitions between trusted and untrusted zones. This reveals attack surfaces where threats can exploit the design.
Threat modeling is a structured process to identify assets, potential attackers, and attack vectors in your system. Apply it early in design to systematically discover security gaps before implementation, then use it during reviews to validate mitigations across authentication, authorization, and data protection.
Secure defaults mean restrictive permissions, encryption enabled by default, and explicit opt-in for risky features. Add comprehensive logging for authentication attempts, authorization decisions, and sensitive data access. Together they satisfy compliance requirements and enable detection of attacks.
Validate and sanitize all external input to prevent injection attacks. Classify data by sensitivity, encrypt data in transit and at rest, and enforce access controls. Document data flows and retention policies to reduce exposure.
Yes. Conduct architectural reviews by examining trust boundaries, authentication and authorization mechanisms, data classification, and logging practices. Apply threat modeling to evaluate whether the design mitigates identified attack scenarios.
Defensive thinking assumes systems work as intended. Attacker-oriented thinking assumes systems will be exploited and designs around that. Threat modeling bridges the gap by systematically considering attacker goals, capabilities, and available attack vectors.
vecearGenerate STRIDE-based threat models with threats, mitigations, and residual risk.
CrashBytesConduct security assessments, threat modeling, and compliance reviews.
franroaImplement secure coding practices for authentication, input validation, and encryption.
wojonsSimulate attacker methodologies to identify security vulnerabilities and penetration vectors across reconnaissance, exploitation, and assessment phases.
