skills.rest
sam-fakhreddine
sam-fakhreddineCOMMUNITY
Explore all skills by this author →
GitHub

wfc-security

Analyzes software projects for security threats using STRIDE methodology and generates security documentation.

Updated Aug 23, 2026
Search Tags:#security#threat modeling#STRIDE#vulnerability scanning#attack surface#secrets detection
One-click install
npx skills add https://github.com/sam-fakhreddine/wfc --skill wfc-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wfc-security
Source: https://github.com/sam-fakhreddine/wfc/tree/main/wfc/skills/wfc-security
Command: npx skills add https://github.com/sam-fakhreddine/wfc --skill wfc-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need for robust security analysis by automating threat modeling, identifying vulnerabilities, and mapping attack surfaces, ensuring code is secure by design.

Core Features & Use Cases

  • STRIDE Threat Modeling: Systematically identifies potential threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
  • Attack Surface Mapping: Visualizes and documents entry points, data flows, and trust boundaries within the application.
  • Dependency Scanning: Detects known vulnerabilities (CVEs) in project dependencies.
  • Secrets Scanning: Finds hardcoded secrets like API keys and credentials.
  • Use Case: Before deploying a new microservice handling user authentication, run /wfc-security to ensure all potential security risks are identified and mitigated.

Quick Start

Run the wfc security skill to perform a full security analysis of the current project.

Frequently Asked Questions about wfc-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform STRIDE threat modeling for my software project?▼

STRIDE threat modeling is performed by systematically identifying Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege risks. This analysis generates a detailed THREAT-MODEL.md document to ensure your application design is secure.

What is the best way to map an application's attack surface and document entry points?▼

Mapping an application's attack surface involves visualizing and documenting entry points, data flows, and trust boundaries. This process produces an ATTACK-SURFACE.md file that highlights potential security risks within your software architecture.

How do I scan third-party dependencies for known vulnerabilities and CVEs?▼

Scanning third-party dependencies for known vulnerabilities detects CVEs within your project libraries. This analysis generates a VULNERABILITIES.md document detailing the identified security flaws to help you mitigate risks before deployment.

Can I detect hardcoded secrets and API keys in my codebase automatically?▼

Detecting hardcoded secrets and API keys in your codebase is done through automated secrets scanning. This identifies exposed credentials within the source code to prevent unauthorized access and ensure compliance.

Does this security analysis require any external dependencies or tools to run?▼

No external dependencies are required to run this security analysis. The Skill operates independently using its internal scripts and references to perform comprehensive threat modeling and vulnerability detection without additional environment setup.

When should I run a comprehensive security analysis on my codebase?▼

You should run a comprehensive security analysis before deploying new microservices or updating critical components like user authentication. This ensures all potential security risks, from attack surface exposure to hardcoded secrets, are identified and mitigated.

Related Skills

Explore More Software Engineering Skills→
stacksjsstacksjs
2

stacks-security-audit

Audit Stacks applications for attack surfaces, OWASP Top 10, STRIDE, and dependencies.

Official
Advanced
n4igmen4igme

sc5-report

Compile validated vulnerability findings into a structured bug bounty report.

Community
Advanced
InnerScopeHearingInnerScopeHearing

sast-configuration

Automate SAST tool setup, custom rule creation, and CI/CD integration.

Official
Advanced
jassicsjassics
6

mobile-pentest

Automate MASTG-based mobile penetration tests on Android and iOS apps.

Community
Advanced