Senior Security
Owns threat modeling (STRIDE, DREAD, data-flow-diagram analysis) and quick secret scans, and routes any other security request to the correct specialist skill.
Before & after
Same prompt, same agent — the only difference is the skill.
That's good thinking to do a threat model before an audit. Threat modeling is definitely a useful exercise to understand where your system might be vulnerable. I can help you walk through some common threat categories and think about what could go wrong with an API. You'd typically consider things like authentication, data exposure, injection attacks, and maybe some denial-of-service scenarios. To do this properly, I'd want to understand more about your API architecture, what kind of data it handles, and who has access. Do you have a diagram of your system? And what's your biggest concern area?
STRIDE THREAT MODEL — API Infrastructure: THREAT ACTOR PERSONAS: • External attacker (low funding, high motivation): rate-limit bypass, credential stuffing • Internal threat (access via contractor): data exfiltration, lateral movement • State-level adversary (unrealistic but in scope): zero-day exploitation THREAT MATRIX: SPOOFING (identity): → API key leakage in logs (likelihood: medium, impact: high) → mitigation: rotate keys weekly, scrub logs → JWT token replay attack (likelihood: low, impact: high) → mitigation: short expiry (15 min), request signing TAMPERING (data): → SQL injection via query parameter (likelihood: low, impact: critical) → mitigation: parameterized queries (confirmed) → Man-in-the-middle on unencrypted endpoint (likelihood: very low, impact: high) → mitigation: TLS 1.3 forced REPUDIATION (accountability): → API caller denies request (likelihood: medium, impact: medium) → mitigation: immutable audit log, signed requests INFORMATION DISCLOSURE: → Error messages leak database schema (likelihood: high, impact: medium) → mitigation: generic error responses → Timing attack on password comparison (likelihood: medium, impact: low) → mitigation: constant-time comparison functions DENIAL OF SERVICE: → Brute-force rate-limit endpoint (likelihood: high, impact: medium) → mitigation: exponential backoff, IP blocking → Billion-record query (likelihood: low, impact: high) → mitigation: pagination + max-result limits ELEVATION OF PRIVILEGE: → Admin endpoint accessible via role confusion (likelihood: low, impact: critical) → mitigation: role-based access control with explicit admin check DREAD RISK SCORES (1-10): • SQL injection: 2 (low likelihood, parameterized) • Information disclosure: 7 (high likelihood, moderate impact) • Rate-limit bypass: 6 (medium) • EoP via role confusion: 5 (low likelihood, critical impact) AUDIT READINESS: Two high-risk items (error message, rate-limit) require fixes before audit. Four-hour remediation window.
About this skill
name: senior-security description: Use when Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist s...
Senior Security
Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist skill (pen-testing, incident response, cloud posture, red team, AI security, threat hunting, secure code review). This skill owns threat modeling; everything else routes to a sibling.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the senior-security skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Senior Security; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
---
name: senior-security
description: Use when a security request needs STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, a quick secret scan, or routing to the right specialist security skill.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
- development
- engineering
---
# Senior Security
Owns threat modeling (STRIDE, DREAD, data-flow-diagram analysis) and quick secret scans, and routes any other security request to the correct specialist skill (pen-testing, incident response, cloud posture, red team, AI security, threat hunting, secure code review).
## When to use
… (sign up to view the full skill)More development skills
View all Development skills →Generate
Scaffold code, tests, and boilerplate from a short spec.
Performance Profiler
Systematic performance profiling for Node.js, Python, and Go applications.
Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Agent Harness
Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.