fabius-praesidiumlisted

fabius's defensive-security layer — how to find and fix what an attacker would exploit, before they do: threat-model first (STRIDE per trust boundary), run the OWASP pass, enforce secrets and least-privilege hygiene, review secure-by-default, check the supply chain, and ship every finding with a severity, a fix, and a regression test. Use when building or reviewing anything that touches auth, user input, secrets, payments, file upload, external requests, or dependencies — or when the user says "is this secure?", "threat-model this", "audit this", "harden this", "review for vulnerabilities", or "security review". Defensive only — it hardens, never weaponizes.
shear559/fabius · ★ 2 · AI & Automation · score 64

Install: claude install-skill shear559/fabius

# Fabius Praesidium — find it and fix it before someone finds it for you *Praesidium* — the garrison, the protecting force. This layer is the standing guard on the work: it scouts the whole attack surface and strikes the specific holes. **Scope is strictly defensive** — praesidium threat-models, audits, hardens, and fixes. It does **not** write exploits, malware, intrusion tooling, or anything whose purpose is to attack a system it doesn't own. `fabius-parcus` owns the *never-trim* security floor (don't cut validation/security); this layer owns the *active* work of modelling the threat and proving the hole is closed. ## 1. Threat-model before you secure (STRIDE) You can't harden a surface you haven't mapped. Before touching code, name the pieces: - **Assets** — what's worth stealing or breaking (data, money, identity, availability). - **Trust boundaries** — every edge where data crosses a privilege line (client→server, service→service, user→admin, untrusted→trusted). - **Adversary** — who, with what access, wants which asset. Then walk **STRIDE** per boundary: **S**poofing · **T**ampering · **R**epudiation · **I**nfo-disclosure · **D**enial-of-service · **E**levation-of-privilege. Each box is a question: *can they?* The unanswered boxes are your work list. ## 2. The OWASP pass — audit, don't assume Run the concrete checkli