security

Identify codebase vulnerabilities using STRIDE and OWASP threat modeling.

5|Updated May 2, 2026

Search Tags:#OWASP #STRIDE #remediation #threat-modeling #code-review #red-team #security-audit

Ready to run

npx skills add https://github.com/vanducng/skills --skill security-vanducng

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security
Source: https://github.com/vanducng/skills/tree/main/skills/security
Command: npx skills add https://github.com/vanducng/skills --skill security-vanducng

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Threat-modeled security audits that apply STRIDE + OWASP lens to surface vulnerabilities from multiple attacker perspectives, with optional red-team discovery and autoresearch-style fix loops for authorized remediation.

Core Features & Use Cases

STRIDE × OWASP threat-pass analysis across a defined scope to rank findings by severity.
Red-team & autoresearch loops for iterative discovery and automated remediation guidance (authorized only).
Credential masking and safe reporting to prevent leakage of secrets in PoCs and reports.
Defensive security posture guidance for codebases, prompts, and model-driven workflows.

Quick Start

Audit the defined code scope with STRIDE×OWASP and generate a severity-ranked findings report.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a STRIDE threat model security audit on my codebase?▼

To perform a STRIDE threat model security audit, this Skill applies the OWASP lens across your defined code scope to identify vulnerabilities and rank findings by severity. It structures the analysis from multiple attacker perspectives.

Can I use red-team discovery loops for automated remediation guidance?▼

Yes, you can use red-team discovery loops for automated remediation guidance. This Skill supports iterative discovery and autoresearch-style fix loops, provided the engagement is strictly authorized.

What is the best way to prevent secret leakage during a security code review?▼

The best way to prevent secret leakage during a security code review is using credential masking. This Skill includes safe reporting capabilities to ensure credentials remain masked throughout PoCs and structured reports.

Does this threat modeling approach work for a full repository scope?▼

Yes, this threat modeling approach works for a full repository scope. You can apply the STRIDE and OWASP analysis across a defined scope or the entire repository to generate a comprehensive severity-ranked findings report.

When should I not use automated red-team engagements for security audits?▼

You should not use automated red-team engagements for security audits when you lack explicit authorization. This Skill strictly requires authorized access for red-team discovery and autoresearch-style fix loops.