security-audit
Purpose
Ensure security requirements are properly defined, implemented, and tested, and
identify vulnerabilities across code, dependencies, infrastructure, and
configuration. Validates compliance against recognized standards (OWASP Top 10,
CWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat
modeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR
security topics upstream of it.
When to Use
Use security-audit when:
- Reviewing the security posture of an SDD project or its implementation.
- Validating that security requirements in SPEC (and upstream EARS/ADR) are
complete and testable.
- Scanning code, dependencies, infrastructure, or configuration for
vulnerabilities, secrets, or compliance gaps.
- Performing threat modeling on a component or system.
Do not use it for general (non-security) artifact quality (use
../quality-advisor/SKILL.md) or traceability validation (use
../doc-validator/SKILL.md).
Behavior
The audit runs as a pipeline, producing a single report:
- Requirements validation — check security requirements (sourced from SPEC
and upstream EARS/ADR) for completeness: authn/authz, data protection,
encryption, key management; flag missing or vague requirements.
- Code scanning — SAST (bandit, semgrep), dependency CVEs (safety,
pip-audit), secret detection (detect-secrets, gitleaks), and pattern checks
for injection, XSS, and CSRF. Critical findings block deployment.
- Infrastructure scanning — IaC (checkov, tfsec), containers (trivy,
grype), Kubernetes, and cloud/network configuration.
- Dependency assessment — known CVEs, CVSS scoring, outdated and transitive
packages, and license-compliance issues.
- Compliance check — OWASP Top 10 (2021) coverage and CWE mapping, plus any
applicable regulatory frameworks.
- Threat modeling — STRIDE analysis, attack-surface and trust-boundary
mapping, with mitigation status per threat.
- Report — overall security score, findings grouped by severity
(critical/high/medium/low) with file:line, CWE/CVE, CVSS, and fix, plus
compliance status and prioritized remediation. Critical issues are marked as
deployment blockers.
Targets: zero critical vulnerabilities, no secrets in the repository, 100%
coverage of MUST security requirements, OWASP Top 10 fully covered.
Limitations: cannot detect all business-logic flaws, may produce false
positives requiring manual review, and depends on current tool vulnerability
databases.
Related Resources
- SPEC layer:
${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/README.md ·
${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/SPEC-TEMPLATE.yaml
- Upstream security topics:
${CLAUDE_PLUGIN_ROOT}/framework/layers/03_EARS/README.md ·
${CLAUDE_PLUGIN_ROOT}/framework/layers/05_ADR/README.md
- Governance:
${CLAUDE_PLUGIN_ROOT}/framework/governance/ (ID, tagging, traceability standards)
- Related skills:
../quality-advisor/SKILL.md · ../doc-validator/SKILL.md ·
../doc-spec/SKILL.md
- References: OWASP Top 10 (2021), CWE, OWASP ASVS
1---2name: security-audit3description: Validate security requirements and assess vulnerabilities across code, dependencies, infrastructure, and configuration, with OWASP/CWE compliance and STRIDE threat modeling. Use to security-review an SDD project or its implementation.4---5
6# security-audit
7
8## Purpose
9
10Ensure security requirements are properly defined, implemented, and tested, and
11identify vulnerabilities across code, dependencies, infrastructure, and
12configuration. Validates compliance against recognized standards (OWASP Top 10,
13CWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat
14modeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR
15security topics upstream of it.
16
17## When to Use
18
19Use `security-audit` when:
20
21- Reviewing the security posture of an SDD project or its implementation.
22- Validating that security requirements in SPEC (and upstream EARS/ADR) are
23 complete and testable.
24- Scanning code, dependencies, infrastructure, or configuration for
25 vulnerabilities, secrets, or compliance gaps.
26- Performing threat modeling on a component or system.
27
28Do **not** use it for general (non-security) artifact quality (use
29`../quality-advisor/SKILL.md`) or traceability validation (use
30`../doc-validator/SKILL.md`).
31
32## Behavior
33
34The audit runs as a pipeline, producing a single report:
35
361. **Requirements validation** — check security requirements (sourced from SPEC
37 and upstream EARS/ADR) for completeness: authn/authz, data protection,
38 encryption, key management; flag missing or vague requirements.
392. **Code scanning** — SAST (bandit, semgrep), dependency CVEs (safety,
40 pip-audit), secret detection (detect-secrets, gitleaks), and pattern checks
41 for injection, XSS, and CSRF. Critical findings block deployment.
423. **Infrastructure scanning** — IaC (checkov, tfsec), containers (trivy,
43 grype), Kubernetes, and cloud/network configuration.
444. **Dependency assessment** — known CVEs, CVSS scoring, outdated and transitive
45 packages, and license-compliance issues.
465. **Compliance check** — OWASP Top 10 (2021) coverage and CWE mapping, plus any
47 applicable regulatory frameworks.
486. **Threat modeling** — STRIDE analysis, attack-surface and trust-boundary
49 mapping, with mitigation status per threat.
507. **Report** — overall security score, findings grouped by severity
51 (critical/high/medium/low) with file:line, CWE/CVE, CVSS, and fix, plus
52 compliance status and prioritized remediation. Critical issues are marked as
53 deployment blockers.
54
55**Targets**: zero critical vulnerabilities, no secrets in the repository, 100%
56coverage of MUST security requirements, OWASP Top 10 fully covered.
57
58**Limitations**: cannot detect all business-logic flaws, may produce false
59positives requiring manual review, and depends on current tool vulnerability
60databases.
61
62## Related Resources
63
64- SPEC layer: `${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/README.md` ·
65 `${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/SPEC-TEMPLATE.yaml`
66- Upstream security topics: `${CLAUDE_PLUGIN_ROOT}/framework/layers/03_EARS/README.md` ·
67 `${CLAUDE_PLUGIN_ROOT}/framework/layers/05_ADR/README.md`
68- Governance: `${CLAUDE_PLUGIN_ROOT}/framework/governance/` (ID, tagging, traceability standards)
69- Related skills: `../quality-advisor/SKILL.md` · `../doc-validator/SKILL.md` ·
70 `../doc-spec/SKILL.md`
71- References: OWASP Top 10 (2021), CWE, OWASP ASVS
vladm3105