security-engineering
Security architecture and implementation patterns. Use when designing security controls, implementing authentication/authorization, conducting threat modeling, or ensuring compliance with security frameworks.
Best use case
security-engineering is best used when you need a repeatable AI agent workflow instead of a one-off prompt. It is especially useful for teams working in multi. Security architecture and implementation patterns. Use when designing security controls, implementing authentication/authorization, conducting threat modeling, or ensuring compliance with security frameworks.
Security architecture and implementation patterns. Use when designing security controls, implementing authentication/authorization, conducting threat modeling, or ensuring compliance with security frameworks.
Users should expect a more consistent workflow output, faster repeated execution, and less time spent rewriting prompts from scratch.
Practical example
Example input
Use the "security-engineering" skill to help with this workflow task. Context: Security architecture and implementation patterns. Use when designing security controls, implementing authentication/authorization, conducting threat modeling, or ensuring compliance with security frameworks.
Example output
A structured workflow result with clearer steps, more consistent formatting, and an output that is easier to reuse in the next run.
When to use this skill
- Use this skill when you want a reusable workflow rather than writing the same prompt again and again.
When not to use this skill
- Do not use this when you only need a one-off answer and do not need a reusable workflow.
- Do not use it if you cannot install or maintain the related files, repository context, or supporting tools.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/security-engineering/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How security-engineering Compares
| Feature / Agent | security-engineering | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Security architecture and implementation patterns. Use when designing security controls, implementing authentication/authorization, conducting threat modeling, or ensuring compliance with security frameworks.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Security Engineering Comprehensive security engineering skill covering application security, infrastructure security, compliance, and incident response. ## When to Use This Skill - Designing security architecture - Implementing authentication and authorization - Conducting threat modeling - Security code review - Implementing compliance controls (SOC2, HIPAA, PCI-DSS) - Incident response planning - Security monitoring and alerting ## Security Architecture ### Defense in Depth Layer security controls at multiple levels: | Layer | Controls | |-------|----------| | Perimeter | Firewall, WAF, DDoS protection | | Network | Segmentation, IDS/IPS, VPN | | Host | Hardening, EDR, patch management | | Application | Input validation, secure coding, SAST/DAST | | Data | Encryption, access control, DLP | | Identity | MFA, SSO, privileged access management | ### Zero Trust Architecture **Core Principles:** 1. Never trust, always verify 2. Assume breach mentality 3. Least privilege access 4. Micro-segmentation 5. Continuous verification **Implementation:** - Identity-based access (not network-based) - Device health verification - Continuous authentication - Encrypted communications everywhere - Detailed logging and monitoring ## Authentication Patterns ### OAuth 2.0 / OIDC **Grant Types:** | Grant | Use Case | |-------|----------| | Authorization Code + PKCE | Web/mobile apps | | Client Credentials | Service-to-service | | Device Code | CLI tools, IoT | **Token Best Practices:** - Short-lived access tokens (15 min - 1 hour) - Secure refresh token storage - Token rotation on use - Revocation capabilities ### Session Management - Secure, HttpOnly, SameSite cookies - Session timeout (idle and absolute) - Session invalidation on logout - Concurrent session limits - Session binding to device/IP ### Multi-Factor Authentication - TOTP (authenticator apps) - WebAuthn/FIDO2 (hardware keys) - Push notifications - SMS (last resort, vulnerable to SIM swap) ## Authorization Patterns ### RBAC (Role-Based Access Control) ``` Users → Roles → Permissions ``` Best for: Well-defined organizational hierarchies ### ABAC (Attribute-Based Access Control) ``` If user.department == "engineering" AND resource.classification == "internal" AND time.hour BETWEEN 9 AND 17 THEN allow ``` Best for: Complex, dynamic access requirements ### Policy as Code Use OPA/Rego or Cedar for externalized policy: - Version controlled policies - Testable access rules - Audit trail - Separation of concerns ## Secure Development ### OWASP Top 10 Mitigations | Risk | Mitigation | |------|------------| | Injection | Parameterized queries, input validation | | Broken Auth | Strong password policy, MFA, rate limiting | | Sensitive Data | Encryption, minimal data collection | | XXE | Disable external entities | | Broken Access | Authorization checks, default deny | | Misconfig | Secure defaults, hardening guides | | XSS | Output encoding, CSP | | Deserialization | Integrity checks, avoid untrusted data | | Components | Dependency scanning, updates | | Logging | Centralized logging, alerting | ### Security Testing **SAST (Static Analysis):** - Run on every commit - Block high-severity findings - Tools: Semgrep, CodeQL, SonarQube **DAST (Dynamic Analysis):** - Run against staging/dev - Tools: OWASP ZAP, Burp Suite **Dependency Scanning:** - Check for known vulnerabilities - Tools: Snyk, Dependabot, npm audit ### Secrets Management **Never:** - Commit secrets to git - Log secrets - Pass secrets in URLs - Hardcode secrets **Do:** - Use secret managers (Vault, AWS Secrets Manager) - Rotate secrets regularly - Audit secret access - Use short-lived credentials ## Compliance Frameworks ### Common Requirements | Framework | Focus Area | |-----------|------------| | SOC 2 | Trust services (security, availability, etc.) | | HIPAA | Healthcare data protection | | PCI-DSS | Payment card data | | GDPR | EU personal data protection | | ISO 27001 | Information security management | ### Key Controls - Access control and authentication - Encryption (at rest and in transit) - Logging and monitoring - Incident response procedures - Business continuity planning - Vendor management - Employee security training ## Incident Response ### Response Phases 1. **Preparation**: Runbooks, tools, training 2. **Detection**: Monitoring, alerting, triage 3. **Containment**: Isolate, preserve evidence 4. **Eradication**: Remove threat, patch vulnerabilities 5. **Recovery**: Restore services, verify clean 6. **Lessons Learned**: Post-mortem, improvements ### Severity Levels | Level | Description | Response Time | |-------|-------------|---------------| | P1 | Active breach, data exfiltration | Immediate | | P2 | Vulnerability being exploited | < 4 hours | | P3 | High-risk vulnerability discovered | < 24 hours | | P4 | Security improvement needed | Next sprint | ## Reference Files - **`references/threat_modeling.md`** - STRIDE methodology and examples - **`references/compliance_controls.md`** - Framework-specific control mappings ## Integration with Other Skills - **cloud-infrastructure** - For cloud security - **debugging** - For security incident investigation - **testing** - For security testing patterns
Related Skills
security-best-practices
Implement security best practices for web applications and infrastructure. Use when securing APIs, preventing common vulnerabilities, or implementing security policies. Handles HTTPS, CORS, XSS, SQL Injection, CSRF, rate limiting, and OWASP Top 10.
web-security-testing
Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.
solidity-security
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
security-scanning-tools
This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system compliance". It provides comprehensive guidance on security scanning tools and methodologies.
security-scanning-security-sast
Static Application Security Testing (SAST) for code vulnerability analysis across multiple languages and frameworks
security-scanning-security-hardening
Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
security-scanning-security-dependencies
You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, assess risks, and recommend remediation.
security-review
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
security-requirement-extraction
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
security-compliance-compliance-check
You are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2, PCI-DSS, and other industry standards. Perform compliance audits and provide implementation guidance.
security-bluebook-builder
Build security Blue Books for sensitive apps
security-auditor
Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and incident response. Use PROACTIVELY for security audits, DevSecOps, or compliance implementation.