security-audit
Purpose
Ensure security requirements are properly defined, implemented, and tested, and
identify vulnerabilities across code, dependencies, infrastructure, and
configuration. Validates compliance against recognized standards (OWASP Top 10,
CWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat
modeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR
security topics upstream of it.
When to Use
Use security-audit when:
- Reviewing the security posture of an SDD project or its implementation.
- Validating that security requirements in SPEC (and upstream EARS/ADR) are
complete and testable.
- Scanning code, dependencies, infrastructure, or configuration for
vulnerabilities, secrets, or compliance gaps.
- Performing threat modeling on a component or system.
Do not use it for general (non-security) artifact quality (use
../quality-advisor/SKILL.md) or traceability validation (use
../doc-validator/SKILL.md).
Behavior
The audit runs as a pipeline, producing a single report:
- Requirements validation — check security requirements (sourced from SPEC
and upstream EARS/ADR) for completeness: authn/authz, data protection,
encryption, key management; flag missing or vague requirements.
- Code scanning — SAST (bandit, semgrep), dependency CVEs (safety,
pip-audit), secret detection (detect-secrets, gitleaks), and pattern checks
for injection, XSS, and CSRF. Critical findings block deployment.
- Infrastructure scanning — IaC (checkov, tfsec), containers (trivy,
grype), Kubernetes, and cloud/network configuration.
- Dependency assessment — known CVEs, CVSS scoring, outdated and transitive
packages, and license-compliance issues.
- Compliance check — OWASP Top 10 (2021) coverage and CWE mapping, plus any
applicable regulatory frameworks.
- Threat modeling — STRIDE analysis, attack-surface and trust-boundary
mapping, with mitigation status per threat.
- Report — overall security score, findings grouped by severity
(critical/high/medium/low) with file:line, CWE/CVE, CVSS, and fix, plus
compliance status and prioritized remediation. Critical issues are marked as
deployment blockers.
Targets: zero critical vulnerabilities, no secrets in the repository, 100%
coverage of MUST security requirements, OWASP Top 10 fully covered.
Limitations: cannot detect all business-logic flaws, may produce false
positives requiring manual review, and depends on current tool vulnerability
databases.
Related Resources
- SPEC layer:
${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/README.md ·
${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/SPEC-TEMPLATE.yaml
- Upstream security topics:
${CLAUDE_PLUGIN_ROOT}/framework/layers/03_EARS/README.md ·
${CLAUDE_PLUGIN_ROOT}/framework/layers/05_ADR/README.md
- Governance:
${CLAUDE_PLUGIN_ROOT}/framework/governance/ (ID, tagging, traceability standards)
- Related skills:
../quality-advisor/SKILL.md · ../doc-validator/SKILL.md ·
../doc-spec/SKILL.md
- References: OWASP Top 10 (2021), CWE, OWASP ASVS
1---
2name: security-audit
3description: Validate security requirements and assess vulnerabilities across code, dependencies, infrastructure, and configuration, with OWASP/CWE compliance and STRIDE threat modeling. Use to security-review an SDD project or its implementation.
4metadata:
5 tags:
6 - sdd-workflow
7 - utility
8 - quality-assurance
9 custom_fields:
10 skill_category: utility
11 upstream_artifacts: [SPEC]
12 downstream_artifacts: []
13 version: "0.25.0"
14 framework_spec_version: "0.51.0"
15 last_updated: "2026-05-23"
16---
17
18# security-audit
19
20## Purpose
21
22Ensure security requirements are properly defined, implemented, and tested, and
23identify vulnerabilities across code, dependencies, infrastructure, and
24configuration. Validates compliance against recognized standards (OWASP Top 10,
25CWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat
26modeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR
27security topics upstream of it.
28
29## When to Use
30
31Use `security-audit` when:
32
33- Reviewing the security posture of an SDD project or its implementation.
34- Validating that security requirements in SPEC (and upstream EARS/ADR) are
35 complete and testable.
36- Scanning code, dependencies, infrastructure, or configuration for
37 vulnerabilities, secrets, or compliance gaps.
38- Performing threat modeling on a component or system.
39
40Do **not** use it for general (non-security) artifact quality (use
41`../quality-advisor/SKILL.md`) or traceability validation (use
42`../doc-validator/SKILL.md`).
43
44## Behavior
45
46The audit runs as a pipeline, producing a single report:
47
481. **Requirements validation** — check security requirements (sourced from SPEC
49 and upstream EARS/ADR) for completeness: authn/authz, data protection,
50 encryption, key management; flag missing or vague requirements.
512. **Code scanning** — SAST (bandit, semgrep), dependency CVEs (safety,
52 pip-audit), secret detection (detect-secrets, gitleaks), and pattern checks
53 for injection, XSS, and CSRF. Critical findings block deployment.
543. **Infrastructure scanning** — IaC (checkov, tfsec), containers (trivy,
55 grype), Kubernetes, and cloud/network configuration.
564. **Dependency assessment** — known CVEs, CVSS scoring, outdated and transitive
57 packages, and license-compliance issues.
585. **Compliance check** — OWASP Top 10 (2021) coverage and CWE mapping, plus any
59 applicable regulatory frameworks.
606. **Threat modeling** — STRIDE analysis, attack-surface and trust-boundary
61 mapping, with mitigation status per threat.
627. **Report** — overall security score, findings grouped by severity
63 (critical/high/medium/low) with file:line, CWE/CVE, CVSS, and fix, plus
64 compliance status and prioritized remediation. Critical issues are marked as
65 deployment blockers.
66
67**Targets**: zero critical vulnerabilities, no secrets in the repository, 100%
68coverage of MUST security requirements, OWASP Top 10 fully covered.
69
70**Limitations**: cannot detect all business-logic flaws, may produce false
71positives requiring manual review, and depends on current tool vulnerability
72databases.
73
74## Related Resources
75
76- SPEC layer: `${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/README.md` ·
77 `${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/SPEC-TEMPLATE.yaml`
78- Upstream security topics: `${CLAUDE_PLUGIN_ROOT}/framework/layers/03_EARS/README.md` ·
79 `${CLAUDE_PLUGIN_ROOT}/framework/layers/05_ADR/README.md`
80- Governance: `${CLAUDE_PLUGIN_ROOT}/framework/governance/` (ID, tagging, traceability standards)
81- Related skills: `../quality-advisor/SKILL.md` · `../doc-validator/SKILL.md` ·
82 `../doc-spec/SKILL.md`
83- References: OWASP Top 10 (2021), CWE, OWASP ASVS
vladm3105