Security Hub — Unified Security Router
Routes security requests to the appropriate specialized sub-skill. Use this router instead of loading individual security skills directly.
Decision Tree
Step 1: Identify Intent
| User Intent |
Sub-Skill |
Load When |
| Code audit, checklist review, pre-deployment checks |
security-review |
User asks to "review security", "check for vulnerabilities", "audit this code" |
| Language-specific best practices (Python/JS/Go) |
security-best-practices |
User asks for "secure coding in [language]", "framework security", "language-specific security" |
| Threat modeling, trust boundaries, abuse paths |
security-threat-model |
User asks to "threat model", "enumerate threats", "attacker paths", "AppSec analysis" |
| Ownership risk, bus factor, maintainer topology |
security-ownership-map |
User asks for "ownership analysis", "bus factor", "who owns sensitive code", "orphaned code" |
Step 2: Clarify Ambiguity
- If intent is unclear, ask: "What type of security work? (1) Code review (2) Language best practices (3) Threat model (4) Ownership analysis"
- If scope is unclear (e.g., "security audit"), default to
security-review (broadest checklist)
Sub-Skill Quick Reference
security-review (Code Audit Checklist)
Pre-deployment security checklist covering: secrets management, input validation, SQL injection, auth/authz, XSS/CSRF, rate limiting, dependency security. Best for: code review, pre-deploy gates, general vulnerability scanning.
security-best-practices (Language/Framework Security)
Language and framework-specific security guidance (Python, JS/TS, Go). Loads reference docs for secure-by-default coding, passive vulnerability detection, and security report generation. Best for: new projects, framework-specific security, secure coding patterns.
security-threat-model (AppSec Threat Modeling)
Repository-grounded threat modeling: trust boundaries, assets, attacker capabilities, abuse paths, and mitigations. Produces Markdown threat model documents. Best for: architecture review, AppSec planning, risk prioritization.
security-ownership-map (Ownership Topology)
Git-based ownership analysis: compute bus factor, identify orphaned sensitive code, map maintainer topology, export graph data (CSV/JSON/GraphML). Best for: security maintainer analysis, CODEOWNERS drift, ownership risk.
Cross-Cutting Workflows
Use multiple sub-skills together for comprehensive security analysis:
New Project Security
- Start:
security-best-practices (secure-by-default patterns)
- Then:
security-review (pre-deploy checklist)
AppSec Deep Dive
- Start:
security-threat-model (enumerate threats)
- Then:
security-review (validate controls)
- Then:
security-ownership-map (identify maintainers for high-risk code)
Incident Response / Post-Mortem
- Start:
security-ownership-map (who owns the vulnerable code?)
- Then:
security-threat-model (how was this exploitable?)
- Then:
security-best-practices (what secure pattern prevents this?)
CODEOWNERS Validation
- Start:
security-ownership-map (compute actual ownership)
- Then:
security-threat-model (identify sensitive boundaries)
- Compare: ownership map vs CODEOWNERS file
Notes
- Progressive disclosure: Load only the sub-skill you need. The router stays small; sub-skills contain the full content.
- No overlap: Each sub-skill has a distinct scope. No redundant checklists across skills.
- Composable: Chain sub-skills together for end-to-end security workflows.
1---2name: security-hub3description: [WHAT] Unified security skill router — routes to the right security sub-skill based on intent [HOW] Decision tree routes to: security-review (code audit), security-best-practices (language-specific), security-threat-model (threat modeling), security-ownership-map (ownership topology) [WHEN] Use when user mentions security, audit, vulnerability, threat model, OWASP, pentest, code review security, ownership analysis [WHY] Prevents loading 4 separate security skills; routes to the right one based on context Triggers: "security", "audit", "vulnerability", "threat model", "OWASP", "pentest", "code review security", "ownership", "bus factor", "security review"4---56# Security Hub — Unified Security Router78Routes security requests to the appropriate specialized sub-skill. Use this router instead of loading individual security skills directly.910## Decision Tree1112**Step 1: Identify Intent**1314| User Intent | Sub-Skill | Load When |15|-------------|-----------|-----------|16| Code audit, checklist review, pre-deployment checks | `security-review` | User asks to "review security", "check for vulnerabilities", "audit this code" |17| Language-specific best practices (Python/JS/Go) | `security-best-practices` | User asks for "secure coding in [language]", "framework security", "language-specific security" |18| Threat modeling, trust boundaries, abuse paths | `security-threat-model` | User asks to "threat model", "enumerate threats", "attacker paths", "AppSec analysis" |19| Ownership risk, bus factor, maintainer topology | `security-ownership-map` | User asks for "ownership analysis", "bus factor", "who owns sensitive code", "orphaned code" |2021**Step 2: Clarify Ambiguity**2223- If intent is unclear, ask: "What type of security work? (1) Code review (2) Language best practices (3) Threat model (4) Ownership analysis"24- If scope is unclear (e.g., "security audit"), default to `security-review` (broadest checklist)2526## Sub-Skill Quick Reference2728### security-review (Code Audit Checklist)29Pre-deployment security checklist covering: secrets management, input validation, SQL injection, auth/authz, XSS/CSRF, rate limiting, dependency security. Best for: code review, pre-deploy gates, general vulnerability scanning.3031### security-best-practices (Language/Framework Security)32Language and framework-specific security guidance (Python, JS/TS, Go). Loads reference docs for secure-by-default coding, passive vulnerability detection, and security report generation. Best for: new projects, framework-specific security, secure coding patterns.3334### security-threat-model (AppSec Threat Modeling)35Repository-grounded threat modeling: trust boundaries, assets, attacker capabilities, abuse paths, and mitigations. Produces Markdown threat model documents. Best for: architecture review, AppSec planning, risk prioritization.3637### security-ownership-map (Ownership Topology)38Git-based ownership analysis: compute bus factor, identify orphaned sensitive code, map maintainer topology, export graph data (CSV/JSON/GraphML). Best for: security maintainer analysis, CODEOWNERS drift, ownership risk.3940## Cross-Cutting Workflows4142Use **multiple sub-skills together** for comprehensive security analysis:43441. **New Project Security**45 - Start: `security-best-practices` (secure-by-default patterns)46 - Then: `security-review` (pre-deploy checklist)47482. **AppSec Deep Dive**49 - Start: `security-threat-model` (enumerate threats)50 - Then: `security-review` (validate controls)51 - Then: `security-ownership-map` (identify maintainers for high-risk code)52533. **Incident Response / Post-Mortem**54 - Start: `security-ownership-map` (who owns the vulnerable code?)55 - Then: `security-threat-model` (how was this exploitable?)56 - Then: `security-best-practices` (what secure pattern prevents this?)57584. **CODEOWNERS Validation**59 - Start: `security-ownership-map` (compute actual ownership)60 - Then: `security-threat-model` (identify sensitive boundaries)61 - Compare: ownership map vs CODEOWNERS file6263## Notes6465- **Progressive disclosure:** Load only the sub-skill you need. The router stays small; sub-skills contain the full content.66- **No overlap:** Each sub-skill has a distinct scope. No redundant checklists across skills.67- **Composable:** Chain sub-skills together for end-to-end security workflows.
lev-os