Security Expert

Security Expert Skill

Quick Start

# 1. Navigation rapide vers un agent
security-expert/agents/appsec/sast              # Analyse statique du code
security-expert/agents/appsec/dast              # Tests dynamiques
security-expert/agents/secure-coding/validation # Validation des entrees
security-expert/agents/threat-modeling/stride   # Methodologie STRIDE
security-expert/agents/penetration/owasp-top10  # Tests OWASP Top 10
security-expert/agents/compliance/rgpd          # Implementation RGPD

# 2. Executer les tests de validation
cd .web-agency/skills/security-expert && npm test

# 3. Questions frequentes
"Comment implementer SAST dans ma CI ?"     -> appsec/sast
"Valider les entrees utilisateur ?"         -> secure-coding/validation
"Faire un threat model de mon app ?"        -> threat-modeling/stride
"Tester les vulnerabilites OWASP ?"         -> penetration/owasp-top10
"Implementer le RGPD techniquement ?"       -> compliance/rgpd

Position dans l'Architecture

Ce skill est au NIVEAU 3 : IMPLEMENTATION. Il implemente les politiques de securite definies par direction-technique/securite.

+---------------------------------------------------------------------------+
|  NIVEAU 1 : STRATEGIE (direction-technique/securite)                       |
|  -> POURQUOI : Politique securite, exigences conformite, budget            |
+----------------------------------------------------------------------------+
|  NIVEAU 2 : PROCESSUS                                                      |
|  +----------------------------+  +----------------------------+            |
|  |     testing-process        |  |       web-dev-process      |            |
|  |  security/ (methodologie)  |  |  testing/security/         |            |
|  |  QUOI : Quels tests faire  |  |  QUOI : Quand tester       |            |
|  +----------------------------+  +----------------------------+            |
+----------------------------------------------------------------------------+
|  NIVEAU 3 : IMPLEMENTATION                                                 |
|  +------------------------------------------------------------------+     |
|  |                    security-expert <- CE SKILL                    |     |
|  |  COMMENT : SAST, DAST, secure coding, pentest, compliance impl    |     |
|  +------------------------------------------------------------------+     |
+----------------------------------------------------------------------------+

Philosophie

Securiser par design, valider en continu.

Ce skill :

• Implemente les outils de securite (SAST, DAST, IAST)
• Guide le secure coding avec des patterns concrets
• Realise les threat models et analyses de risques
• Execute les tests de penetration
• Implemente la conformite (RGPD, SOC2, ISO27001)

Il ne fait PAS :

• Les decisions strategiques de securite -> direction-technique/securite
• La definition des process de tests securite -> testing-process/security
• La gestion des incidents -> direction-technique/support/gestion-incidents
• La configuration infrastructure securisee -> devops/infrastructure

Domaines et Agents (24 agents)

1. appsec/ - Application Security (5 agents)

Outils et implementation de la securite applicative.

2. secure-coding/ - Developpement Securise (5 agents)

Patterns et pratiques de code securise.

3. threat-modeling/ - Modelisation des Menaces (4 agents)

Identification et analyse des risques.

4. penetration/ - Tests de Penetration (5 agents)

Tests offensifs et identification de vulnerabilites.

5. compliance/ - Conformite (5 agents)

Implementation des standards de conformite.

Total : 24 agents specialises

Regles de Routage

Par Type de Question

Par Mots-Cles

Arbre de Decision

Requete Security
|
+-- Concerne les outils de scan/analyse ?
|   +-- Analyse statique du code -> appsec/sast
|   +-- Tests dynamiques -> appsec/dast
|   +-- Runtime instrumentation -> appsec/iast
|   +-- Dependances vulnerables -> appsec/sca
|
+-- Concerne le code securise ?
|   +-- Validation entrees -> secure-coding/validation
|   +-- Authentification -> secure-coding/authentication
|   +-- Autorisation -> secure-coding/authorization
|   +-- Chiffrement -> secure-coding/cryptography
|
+-- Concerne l'analyse des risques ?
|   +-- Threat modeling STRIDE -> threat-modeling/stride
|   +-- Arbres d'attaque -> threat-modeling/attack-trees
|   +-- Evaluation risques -> threat-modeling/risk-assessment
|
+-- Concerne les tests de penetration ?
|   +-- OWASP Top 10 -> penetration/owasp-top10
|   +-- Securite API -> penetration/api-security
|   +-- Vulns web specifiques -> penetration/web-vulnerabilities
|   +-- Rapports pentest -> penetration/reporting
|
+-- Concerne la conformite ?
|   +-- RGPD/GDPR -> compliance/rgpd
|   +-- SOC2 -> compliance/soc2
|   +-- ISO 27001 -> compliance/iso27001
|   +-- PCI DSS -> compliance/pci-dss
|
+-- Decision strategique securite ?
|   +-- -> direction-technique/securite
|
+-- Methodologie de test securite ?
    +-- -> testing-process/security

Interaction avec les Autres Skills

Flux Entrants

direction-technique/securite --> security-expert (politique -> implementation)
testing-process/security --> security-expert (methodologie -> outils)
web-dev-process/testing --> security-expert (phase testing -> execution)

Flux Sortants

security-expert --> backend-developer (patterns securises backend)
security-expert --> frontend-developer (patterns securises frontend)
security-expert --> devops (integration CI/CD securite)

Points d'Escalade

Vers direction-technique

Vers l'humain

Security Principles

Defense in Depth

+------------------------------------------+
|              WAF / CDN                   |
|  +------------------------------------+  |
|  |         Load Balancer              |  |
|  |  +------------------------------+  |  |
|  |  |    Application (validated)   |  |  |
|  |  |  +-----------------------+   |  |  |
|  |  |  |   Business Logic     |   |  |  |
|  |  |  |  +----------------+  |   |  |  |
|  |  |  |  | Data (encrypted)|  |   |  |  |
|  |  |  |  +----------------+  |   |  |  |
|  |  |  +-----------------------+   |  |  |
|  |  +------------------------------+  |  |
|  +------------------------------------+  |
+------------------------------------------+

OWASP Top 10 Coverage

Skills Associes

Changelog

v1.0.0

• Creation initiale avec 5 domaines et 24 agents
• Position : NIVEAU 3 IMPLEMENTATION
• Couverture : appsec, secure-coding, threat-modeling, penetration, compliance