skills.rest
StrangeDaysTech
StrangeDaysTechOFFICIAL
Explore all skills by this author →
Website𝕏@StrangeDaysTechGitHub

straymark-sec

Generate a draft StrayMark Security Assessment document with OWASP ASVS controls.

2|Updated Apr 2, 2026
Search Tags:#documentation#threat modeling#compliance#code context#security assessment#draft review#owasp asvs
One-click install
npx skills add https://github.com/StrangeDaysTech/arborist-cli --skill straymark-sec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: straymark-sec
Source: https://github.com/StrangeDaysTech/arborist-cli/tree/main/.gemini/skills/straymark-sec
Command: npx skills add https://github.com/StrangeDaysTech/arborist-cli --skill straymark-sec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It streamlines creating Security Assessment (SEC) documentation by guiding an analyst through scoping, threat modeling methodology selection, and OWASP ASVS level targeting, then producing a pre-filled draft ready for human review.

Core Features & Use Cases

  • Interactive security assessment workflow: Collects component scope, selects a threat modeling methodology (STRIDE/PASTA/LINDDUN/Custom), and chooses the OWASP ASVS verification level.
  • Context-informed drafting: Uses repository context (git status/diff and targeted security-relevant pattern scanning) to populate threat model and ASVS compliance sections.
  • Draft-first, review-required output: Always generates a document marked as draft with review_required, risk_level high, and a medium confidence signal, saving it into the expected .straymark/08-security/ location.

Quick Start

Invoke /straymark-sec with your component name (for example, /straymark-sec authentication-api) and answer the prompted questions to generate a draft SEC document with populated scope, threats, and ASVS controls.

Frequently Asked Questions about straymark-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a draft security assessment document with OWASP ASVS controls?▼

To generate a draft security assessment document, you invoke an interactive workflow that collects component scope, selects a threat modeling methodology, and targets an OWASP ASVS verification level to produce a pre-filled template for human review.

What threat modeling methodologies can I use for codebase-aware security documentation?▼

For codebase-aware security documentation, you can select from STRIDE, PASTA, LINDDUN, or Custom threat modeling methodologies to populate the threat model sections of your assessment draft.

Does the security assessment workflow require git repository context to populate threats?▼

The security assessment workflow uses git repository context, including git status and diff along with security-relevant pattern scanning, to inform and populate threat model and ASVS compliance sections in the generated draft.

Can I use this security assessment template generator for component-level compliance mapping?▼

Yes, this security assessment template generator applies specifically to component-level security documentation for codebase-aware threat modeling and ASVS-oriented control mapping scenarios within your repository.

What is the review status of the generated security assessment draft?▼

The generated security assessment draft is always marked with a draft status, a review_required flag, a high risk level, and a medium confidence signal, saving directly into the expected .straymark/08-security/ location.

Related Skills

Explore More Legal & Compliance Skills→
securityreviewaisecurityreviewai

project-overview-analysis

Analyzes Git repositories to produce summaries of their structure, risks, and key components.

Official
Intermediate
FernanSuozaFernanSuoza

sec-risk-security-review

Perform OWASP ASVS-aligned threat modeling and risk assessment for proposed architectures.

Community
Advanced
ensingm2ensingm2
12

threat-modeler

Apply STRIDE, MITRE ATT&CK, and Kill Chain frameworks to identify and model security threats.

Community
Advanced
AidenSbVevoAidenSbVevo
1

security-audit

Orchestrate static analysis, supply-chain risk, and configuration review with Semgrep and CodeQL.

Community
Advanced