Senior Security Engineer — Threat Modeling + Security Router
This skill does exactly one job itself — STRIDE/DREAD threat modeling (plus a quick secret scan) — and routes every other security request to the specialist skill that owns that lane. Do not duplicate sibling content here; route instead.
Routing Table (read this first)
| The user wants... |
Route to |
Why that skill owns it |
| Vulnerability assessment, pen-test methodology, OWASP Top 10 testing |
../security-pen-testing/ |
Ships vulnerability_scanner.py + dependency_auditor.py with exit-code contracts |
| Incident triage, SEV classification, forensics, containment |
../incident-response/ |
SEV1–SEV4 taxonomy, NIST SP 800-61 phases, incident_triage.py |
| Production outage command (non-security incidents) |
../incident-commander/ |
Severity classifier + timeline + postmortem tools |
| Security monitoring, CVE triage SLAs, compliance checks (SOC 2 etc.), security headers |
../senior-secops/ |
security_scanner.py + compliance_checker.py, CVE SLA table |
| Hostile/adversarial code review |
../adversarial-reviewer/ |
3-persona review with BLOCK/CONCERNS/CLEAN verdict |
| Secure code review as part of general review |
../code-reviewer/ |
Language dispatch + regression fixtures |
| Cloud IAM escalation paths, S3 exposure, security groups |
../cloud-security/ |
cloud_posture_check.py with per-check exit codes |
| Threat hunting, IOC sweeps, anomaly detection |
../threat-detection/ |
z-score anomaly + IOC staleness tooling |
| Red-team engagement planning, ATT&CK kill chains |
../red-team/ |
engagement_planner.py with authorization gate |
| LLM/AI attack surface (prompt injection, poisoning) |
../ai-security/ |
ATLAS-mapped ai_threat_scanner.py |
If the request spans lanes (e.g., "secure this new architecture"), do the threat model here first — its output (prioritized threats + mitigations) tells you which siblings to load next. Never bulk-load multiple security skills speculatively.
What This Skill Owns: STRIDE Threat Modeling
Workflow
- Scope: assets to protect, trust boundaries, data flows (external entities, processes, data stores, flows).
- Generate the threat model per component:
python3 scripts/threat_modeler.py --component "User Authentication" --assets "credentials,sessions" --json --output threats.json
Output: per-threat STRIDE category, DREAD score (Damage, Reproducibility, Exploitability, Affected users, Discoverability — each 1–10), and suggested mitigations. Repeat per DFD element; --interactive walks scoping questions; --list-threats shows the threat database.
- Consume the output: sort
threats.json by DREAD score descending; everything ≥ 7 average needs a named mitigation owner before the design ships. Map each mitigation to the responsible sibling lane (e.g., IAM threats → cloud-security, injection threats → code-reviewer).
- Quick secret sweep while you have the codebase open:
python3 scripts/secret_scanner.py /path/to/project --format json --severity high
20+ patterns (AWS keys, GitHub tokens, private keys, generic credentials). Any critical/high finding blocks merge until rotated and moved to a secret manager.
- Verification gate: every DFD element has ≥ 1 STRIDE row considered, every threat with DREAD ≥ 7 has an owner + mitigation, and the secret scan exits with zero high/critical findings. Re-run both tools after mitigations land — that re-run is the done signal, not the document.
STRIDE per Element Matrix
| DFD Element |
S |
T |
R |
I |
D |
E |
| External Entity |
X |
|
X |
|
|
|
| Process |
X |
X |
X |
X |
X |
X |
| Data Store |
|
X |
X |
X |
X |
|
| Data Flow |
|
X |
|
X |
X |
|
(S=Spoofing→authn, T=Tampering→integrity, R=Repudiation→audit logs, I=Info Disclosure→encryption/access control, D=DoS→rate limiting/redundancy, E=Elevation→least privilege.)
References (load on demand)
| Document |
Content |
| references/threat-modeling-guide.md |
STRIDE methodology, attack trees, DREAD scoring, DFD creation |
| references/security-architecture-patterns.md |
Zero Trust, defense-in-depth, authentication patterns, API security |
| references/cryptography-implementation.md |
AES-GCM, Ed25519, password hashing (Argon2id), key management |
The architecture and crypto references are kept because no sibling ships them; for operating those controls (scanning, compliance, monitoring) still route to senior-secops.
1---2name: senior-security3description: Routes security requests to specialist skills and performs STRIDE/DREAD threat modeling with a quick secret scan.4---56# Senior Security Engineer — Threat Modeling + Security Router78This skill does exactly one job itself — **STRIDE/DREAD threat modeling** (plus a quick secret scan) — and routes every other security request to the specialist skill that owns that lane. Do not duplicate sibling content here; route instead.910## Routing Table (read this first)1112| The user wants... | Route to | Why that skill owns it |13|---|---|---|14| Vulnerability assessment, pen-test methodology, OWASP Top 10 testing | `../security-pen-testing/` | Ships `vulnerability_scanner.py` + `dependency_auditor.py` with exit-code contracts |15| Incident triage, SEV classification, forensics, containment | `../incident-response/` | SEV1–SEV4 taxonomy, NIST SP 800-61 phases, `incident_triage.py` |16| Production outage command (non-security incidents) | `../incident-commander/` | Severity classifier + timeline + postmortem tools |17| Security monitoring, CVE triage SLAs, compliance checks (SOC 2 etc.), security headers | `../senior-secops/` | `security_scanner.py` + `compliance_checker.py`, CVE SLA table |18| Hostile/adversarial code review | `../adversarial-reviewer/` | 3-persona review with BLOCK/CONCERNS/CLEAN verdict |19| Secure code review as part of general review | `../code-reviewer/` | Language dispatch + regression fixtures |20| Cloud IAM escalation paths, S3 exposure, security groups | `../cloud-security/` | `cloud_posture_check.py` with per-check exit codes |21| Threat hunting, IOC sweeps, anomaly detection | `../threat-detection/` | z-score anomaly + IOC staleness tooling |22| Red-team engagement planning, ATT&CK kill chains | `../red-team/` | `engagement_planner.py` with authorization gate |23| LLM/AI attack surface (prompt injection, poisoning) | `../ai-security/` | ATLAS-mapped `ai_threat_scanner.py` |2425If the request spans lanes (e.g., "secure this new architecture"), do the threat model here first — its output (prioritized threats + mitigations) tells you which siblings to load next. Never bulk-load multiple security skills speculatively.2627## What This Skill Owns: STRIDE Threat Modeling2829### Workflow30311. **Scope:** assets to protect, trust boundaries, data flows (external entities, processes, data stores, flows).322. **Generate the threat model** per component:33 ```bash34 python3 scripts/threat_modeler.py --component "User Authentication" --assets "credentials,sessions" --json --output threats.json35 ```36 Output: per-threat STRIDE category, DREAD score (Damage, Reproducibility, Exploitability, Affected users, Discoverability — each 1–10), and suggested mitigations. Repeat per DFD element; `--interactive` walks scoping questions; `--list-threats` shows the threat database.373. **Consume the output:** sort `threats.json` by DREAD score descending; everything ≥ 7 average needs a named mitigation owner before the design ships. Map each mitigation to the responsible sibling lane (e.g., IAM threats → `cloud-security`, injection threats → `code-reviewer`).384. **Quick secret sweep** while you have the codebase open:39 ```bash40 python3 scripts/secret_scanner.py /path/to/project --format json --severity high41 ```42 20+ patterns (AWS keys, GitHub tokens, private keys, generic credentials). Any critical/high finding blocks merge until rotated and moved to a secret manager.435. **Verification gate:** every DFD element has ≥ 1 STRIDE row considered, every threat with DREAD ≥ 7 has an owner + mitigation, and the secret scan exits with zero high/critical findings. Re-run both tools after mitigations land — that re-run is the done signal, not the document.4445### STRIDE per Element Matrix4647| DFD Element | S | T | R | I | D | E |48|-------------|---|---|---|---|---|---|49| External Entity | X | | X | | | |50| Process | X | X | X | X | X | X |51| Data Store | | X | X | X | X | |52| Data Flow | | X | | X | X | |5354(S=Spoofing→authn, T=Tampering→integrity, R=Repudiation→audit logs, I=Info Disclosure→encryption/access control, D=DoS→rate limiting/redundancy, E=Elevation→least privilege.)5556## References (load on demand)5758| Document | Content |59|----------|---------|60| [references/threat-modeling-guide.md](references/threat-modeling-guide.md) | STRIDE methodology, attack trees, DREAD scoring, DFD creation |61| [references/security-architecture-patterns.md](references/security-architecture-patterns.md) | Zero Trust, defense-in-depth, authentication patterns, API security |62| [references/cryptography-implementation.md](references/cryptography-implementation.md) | AES-GCM, Ed25519, password hashing (Argon2id), key management |6364The architecture and crypto references are kept because no sibling ships them; for *operating* those controls (scanning, compliance, monitoring) still route to `senior-secops`.
Alireza Rezvani