skills.rest
syntropic137
syntropic137OFFICIAL
Explore all skills by this author →
GitHub

security

Identify and mitigate codebase security vulnerabilities during code review.

Updated May 28, 2026
Search Tags:#code review#security#secret management#threat modeling#sast#vulnerability scanning#llm security
One-click install
npx skills add https://github.com/syntropic137/harness-app-template --skill security-syntropic137
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/syntropic137/harness-app-template/tree/main/.claude/skills/security
Command: npx skills add https://github.com/syntropic137/harness-app-template --skill security-syntropic137

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the risk of inconsistent, ad-hoc security practices that leave codebases exposed to common and high-impact attacks including secret leaks, injection vulnerabilities, broken access control, SSRF flaws, and LLM-specific threats like prompt injection, ensuring security controls are explicit, enforced, and layered rather than relying on reviewer memory alone.

Core Features & Use Cases

  • Vulnerability Detection: Identifies hardcoded secrets, unparameterized queries, missing SAST gates, unpatched dependency CVEs, and SSRF risks during code review and CI pipeline configuration.
  • Security Guardrail Enforcement: Guides implementation of centralized authorization, input validation, log redaction, and defense-in-depth controls to prevent data leaks and unauthorized access.
  • Threat Modeling Support: Provides a STRIDE-style framework for analyzing high-stakes changes like new auth flows, third-party integrations, and agentic-AI tooling to catch design-level security flaws before code is written.
  • Use Case: For example, when building a new feature that processes user payment data, this skill ensures secrets are stored in a managed vault, all database queries use parameterization, outbound calls are SSRF-protected, and a threat model is attached to the design draft.

Quick Start

Use the security skill to review the latest pull request for hardcoded secrets, missing input validation, unpatched dependency CVEs, and gaps in authorization controls.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect hardcoded secrets and injection flaws during code review?▼

Threat modeling secures new auth flows by applying a STRIDE-style framework to analyze high-stakes changes before code is written. This approach catches design-level security flaws and ensures defense-in-depth controls are validated against OWASP and NIST standards.

How do I secure agentic-AI tooling against prompt injection and LLM attacks?▼

Securing agentic-AI tooling against prompt injection involves identifying LLM-specific attack surfaces during threat modeling. This ensures explicit security controls validate outbound calls for SSRF protection and enforce strict access boundaries across polyglot software projects.

Can I configure CI pipeline security gates to enforce SAST and dependency scanning?▼

You can configure CI pipeline security gates to enforce SAST and dependency scanning by validating committed security rules as CI fitness functions. This ensures unpatched dependency CVEs and missing SAST gates are caught before code ships.

What is the best way to prevent SSRF risks when integrating third-party services?▼

The best way to prevent SSRF risks when integrating third-party services is to enforce defense-in-depth security controls with explicit outbound call validation. This mitigates unauthorized access by ensuring all external requests are SSRF-protected.

Related Skills

Explore More Software Engineering Skills→
cegit27cegit27
3

cso

Audit infrastructure security across secrets, dependencies, CI/CD, and LLM/AI.

Official
Advanced
hyperb1isshyperb1iss
25

security

Automate security reviews, threat modeling, and incident response guidance.

Community
Intermediate
lucasloutayflucasloutayf

security-and-hardening

Identify and mitigate security vulnerabilities in web services and APIs.

Community
Advanced
AnsteorraAnsteorra
6

security-audit

Perform static and dynamic security audits on the KMP application.

Official
Advanced