straymark-seclisted

# StrayMark Security Assessment Skill Create a Security Assessment document with threat modeling and OWASP ASVS compliance checks. ## Instructions When invoked via `/straymark-sec [component-name]`, follow these steps: ### 1. Gather Assessment Scope If the user provided a `[component-name]`, use it as the system/component under assessment. If no component was specified, **ask the user**: ``` What system or component would you like to assess? Examples: "authentication API", "payment gateway", "user data pipeline" ``` Wait for the user to respond before proceeding. ### 2. Ask Threat Model Methodology Present the available methodologies and ask the user to choose: ``` Which threat modeling methodology would you like to use? 1. STRIDE (recommended) - Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege 2. PASTA - Process for Attack Simulation and Threat Analysis 3. LINDDUN - Linkability, Identifiability, Non-repudiation, Detectability, Disclosure, Unawareness, Non-compliance 4. Custom - Define your own methodology Select [1/2/3/4] (default: 1): ``` Wait for the user to respond before proceeding. ### 3. Ask Target OWASP ASVS Level Ask the user to select the verification level: ``` Which OWASP ASVS verification level should be targeted? L1 - Opportunistic: Basic security controls (default for most apps) L2 - Standard: For apps handling sensitive data L3 - Advanced: For critical infrastructure, medical, f