# Cyber Security

> Vulnerability assessment, defensive programming, and attack prevention

- Skill: `majiayu000/cyber-security` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/cyber-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/cyber-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/cyber-security

---


# Skill: cyber-security

## What I do

I provide a defensive mindset for building resilient systems. I focus on identifying potential attack vectors, implementing robust security controls, and ensuring that security is integrated throughout the development lifecycle rather than added as an afterthought.

## When to use me

- During architectural design to model potential threats
- When selecting or updating third-party dependencies
- Before exposing new endpoints or services to the internet
- When implementing authentication or authorisation logic
- During security-focused code reviews

## Core principles

1. **Defence in depth** — Never rely on a single security control. Implement multiple layers of protection.
2. **Least privilege** — Grant only the minimum access required for a component or user to perform its function.
3. **Assume breach** — Design systems under the assumption that an attacker may already have access to part of the network.
4. **Secure by design** — Security should be a fundamental requirement from the start, not a checklist item at the end.

## Patterns & examples

**Threat Modelling (STRIDE):**
- **Spoofing**: Can someone pretend to be another user?
- **Tampering**: Can data be modified in transit or at rest?
- **Repudiation**: Can a user deny performing an action?
- **Information Disclosure**: Can sensitive data be leaked?
- **Denial of Service**: Can the system be overwhelmed?
- **Elevation of Privilege**: Can a user gain unauthorised access levels?

**Defensive Programming Pattern:**
```typescript
// ✅ Correct: Validate all inputs, use secure defaults, and fail securely
async function processSensitiveData(userId: string, payload: unknown) {
  // 1. Validate userId format
  if (!isValidUUID(userId)) throw new SecurityError("Invalid ID");

  // 2. Authorise user action
  const hasAccess = await checkPermissions(userId, 'write');
  if (!hasAccess) throw new ForbiddenError("Unauthorised action");

  // 3. Sanitise and validate payload schema
  const cleanData = Schema.parse(payload);

  // 4. Process securely...
}
```

## Anti-patterns to avoid

- ❌ **Security through obscurity** — Relying on secret algorithms or hidden URLs is not a valid security strategy.
- ❌ **Hardcoding secrets** — API keys and credentials must never be committed to version control.
- ❌ **Trusting user input** — Every piece of data from a client must be treated as malicious until validated.

## KB Reference

`~/vaults/baphled/3. Resources/Knowledge Base/AI Development System/Skills/Security/Cyber Security.md`

## Related skills

- `security` — Core secure coding practices and implementation
- `check-compliance` — Automated security scanning and linting
- `static-analysis` — Identifying logic flaws and vulnerabilities
- `dependency-management` — Managing third-party risk