BMAD Security Review Skill
When to Invoke
Activate this skill whenever the user:
- Requests a security, privacy, or compliance review of a feature or system.
- Mentions threat modeling, secure design, risk assessment, or penetration testing.
- Asks for guidance on hardening infrastructure, APIs, data flows, or deployment pipelines.
- Needs a remediation backlog prior to launch or certification.
- Receives external audit findings that must be triaged and addressed.
Do not invoke when the user only needs implementation help with security stories—route those to bmad-development-execution once the remediation plan exists.
Mission
Protect the product by exposing security risks early, prioritizing fixes, and embedding mitigations into the delivery plan. Deliver artifacts that downstream skills and teams can execute without ambiguity.
Inputs Required
- Architecture decisions, diagrams, or code references (
docs/architecture.md, repositories, infrastructure manifests).
- Current product requirements, especially data handling and auth flows.
- Any existing penetration test reports, compliance requirements, or known incidents.
- Deployment environment details (cloud provider, runtimes, integrations).
If critical context is missing, schedule discovery steps in WORKFLOW.md before producing findings.
Outputs
- Threat model covering data flows, trust boundaries, STRIDE analysis, and mitigations using templates in
assets/.
- Security gap assessment summarizing findings by severity with clear owners and due dates.
- Remediation backlog with prioritized user stories and acceptance criteria ready for
bmad-story-planning.
- Optional compliance checklists (SOC2, HIPAA, GDPR) when requested.
Process
- Confirm prerequisites are satisfied (architecture + test strategy). Request missing artifacts.
- Map system boundaries and data classifications. Document entry points and critical assets.
- Run threat modeling workshops: enumerate threats via STRIDE/LINDDUN and rate likelihood × impact.
- Review code, dependencies, and infrastructure for known vulnerabilities or misconfigurations.
- Summarize findings with severity, evidence, and references to assets or standards violated.
- Translate mitigations into actionable backlog items. Align with release timelines.
- Provide launch go/no-go recommendation and residual risk statement.
Quality Gates
- No critical/high risks without documented mitigation and owner.
- Threat model reviewed against latest architecture diagram.
- Remediation backlog linked to acceptance criteria consumable by dev/test skills.
- Compliance requirements traced to controls or follow-up activities.
Error Handling
- If findings rely on missing context, pause and obtain evidence before finalizing reports.
- Escalate systemic issues (e.g., absence of IAM, encryption gaps) to product leadership via orchestrator.
- Document assumptions; flag when runtime verification (DAST/SAST) is required beyond conversational review.
1---2name: bmad-security-review3description: Hardens designs and implementations with structured security reviews.4---5
6# BMAD Security Review Skill
7
8## When to Invoke
9
10Activate this skill whenever the user:
11- Requests a security, privacy, or compliance review of a feature or system.
12- Mentions threat modeling, secure design, risk assessment, or penetration testing.
13- Asks for guidance on hardening infrastructure, APIs, data flows, or deployment pipelines.
14- Needs a remediation backlog prior to launch or certification.
15- Receives external audit findings that must be triaged and addressed.
16
17Do **not** invoke when the user only needs implementation help with security stories—route those to `bmad-development-execution` once the remediation plan exists.
18
19## Mission
20
21Protect the product by exposing security risks early, prioritizing fixes, and embedding mitigations into the delivery plan. Deliver artifacts that downstream skills and teams can execute without ambiguity.
22
23## Inputs Required
24
25- Architecture decisions, diagrams, or code references (`docs/architecture.md`, repositories, infrastructure manifests).
26- Current product requirements, especially data handling and auth flows.
27- Any existing penetration test reports, compliance requirements, or known incidents.
28- Deployment environment details (cloud provider, runtimes, integrations).
29
30If critical context is missing, schedule discovery steps in `WORKFLOW.md` before producing findings.
31
32## Outputs
33
34- **Threat model** covering data flows, trust boundaries, STRIDE analysis, and mitigations using templates in `assets/`.
35- **Security gap assessment** summarizing findings by severity with clear owners and due dates.
36- **Remediation backlog** with prioritized user stories and acceptance criteria ready for `bmad-story-planning`.
37- Optional compliance checklists (SOC2, HIPAA, GDPR) when requested.
38
39## Process
40
411. Confirm prerequisites are satisfied (architecture + test strategy). Request missing artifacts.
422. Map system boundaries and data classifications. Document entry points and critical assets.
433. Run threat modeling workshops: enumerate threats via STRIDE/LINDDUN and rate likelihood × impact.
444. Review code, dependencies, and infrastructure for known vulnerabilities or misconfigurations.
455. Summarize findings with severity, evidence, and references to assets or standards violated.
466. Translate mitigations into actionable backlog items. Align with release timelines.
477. Provide launch go/no-go recommendation and residual risk statement.
48
49## Quality Gates
50
51- No critical/high risks without documented mitigation and owner.
52- Threat model reviewed against latest architecture diagram.
53- Remediation backlog linked to acceptance criteria consumable by dev/test skills.
54- Compliance requirements traced to controls or follow-up activities.
55
56## Error Handling
57
58- If findings rely on missing context, pause and obtain evidence before finalizing reports.
59- Escalate systemic issues (e.g., absence of IAM, encryption gaps) to product leadership via orchestrator.
60- Document assumptions; flag when runtime verification (DAST/SAST) is required beyond conversational review.
majiayu000