security

Solid

Use before shipping to production. Performs OWASP Top 10 audit and STRIDE threat modeling against the codebase. Supports --quick, --standard, --thorough modes. Also use when the user asks to check security, audit code, or review for vulnerabilities. Triggers on /security.

Code & Development 1 stars 0 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 80/100

Stars 20%
10
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# /security — Security Audit You think like an attacker but report like a defender. The real attack surface is rarely the code you wrote. It is the secrets in git history, the dependency you forgot to update, the CI pipeline that leaks tokens, and the AI endpoint without rate limiting. Start there, not at the application logic. ## Intensity Mode | Mode | Flag | Scope | Confidence gate | |------|------|-------|-----------------| | **Quick** | `--quick` | OWASP A01-A03 (top 3) + secrets scan + dependency check | 9/10 — only verified findings | | **Standard** | (default) | Full OWASP A01-A10 + STRIDE per component + dependencies | 7/10 — report anything with evidence | | **Thorough** | `--thorough` | Full OWASP + STRIDE + variant analysis + conflict detection + LLM security check | 3/10 — flag tentative findings marked as TENTATIVE | Auto-suggest: - Pre-commit on small changes → suggest `--quick` - Pre-ship standard feature → `--standard` (default) - Pre-ship auth/payment/infra, or first audit of a codebase → suggest `--thorough` **Thorough-only features:** - **Variant analysis:** When a finding is VERIFIED, search the entire codebase for the same pattern. One confirmed SQL injection means there may be more. - **Conflict detection:** Cross-reference with `/review` artifacts in `.nanostack/review/` for contradictions. - **TENTATIVE findings:** Below confidence gate but worth noting. Mark as `TENTATIVE: <description>`. ## Setup (first run per project) **Resolve context** — ...

Details

Author
Jihadyip286
Repository
Jihadyip286/nanostack
Created
3 months ago
Last Updated
today
Language
Shell
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

security-audit

OWASP Top 10 + STRIDE threat model pass on the current codebase, or on the current branch diff. Emits a findings report with severity, confidence, and exploit scenario. Use alongside Claude Code's built-in /security-review for spot checks, and whenever the diff touches auth, credentials, tool policy, shell execution, or data persistence. Adapted from Garry Tan's gstack /cso (garrytan/gstack); role framing stripped.

2 Updated 2 days ago
RobertIlisei
Code & Development Listed

security-review

Comprehensive security audit of code changes. Analyzes changed files for OWASP Top 10 vulnerabilities, injection flaws, authentication issues, secrets exposure, and insecure patterns. Produces a structured report with severity ratings, confidence scores, and actionable remediations. Use when the user says 'security review', 'security audit', 'check for vulnerabilities', 'OWASP check', 'is this safe', 'check my code', 'vulnerability check', '/security-review', or asks to review code for security issues. Do NOT trigger for general code quality reviews, refactoring, or non-security concerns.

3 Updated 3 days ago
arthjean
AI & Automation Solid

security

Threat-modeled security audit using STRIDE + OWASP (incl. the OWASP LLM Top-10 lens for AI/agent code), scanning code from multiple attacker perspectives, with optional red-team discovery loop and an autoresearch-style fix loop. Use for defensive security review, vulnerability discovery, threat modeling, prompt-injection / LLM security, and authorized remediation. Triggers: 'security audit', 'STRIDE', 'OWASP', 'find vulnerabilities', 'threat model', 'red-team this', 'is this secure', 'prompt injection', 'LLM security'.

2 Updated today
vanducng