القائمة
Security assessment using STRIDE threat modeling, OWASP Top 10, and CVSS scoring. Use for security reviews, threat modeling, and secure coding guidance.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Self-improving agent architecture using ChromaDB for continuous learning, self-evaluation, and improvement storage. Agents maintain separate memory collections for learned patterns, performance metrics, and self-assessments without modifying their static .md configuration.
Guide for manually creating custom skills from scratch with templates and validation. Use when designing NEW skills with specific requirements. For auto-generating skills from existing git repos, use /generate-skills instead.
Display QAVR (Q-Value Augmented Vector Retrieval) system status including mode, interaction counts, top memories by Q-value, and configuration.
Enables continuous self-improvement through learning from failures, user corrections, and capability gaps. Integrates with QAVR for learned memory ranking.
Stress-test solutions using the STRIKE framework. Systematically attack proposals to find weaknesses before deployment.
Exhaustive solution space exploration. Use when you need ALL viable options (not just the best), solution space is unknown, or you can't afford to miss alternatives.
| name | security-analysis |
| description | Security assessment using STRIDE threat modeling, OWASP Top 10, and CVSS scoring. Use for security reviews, threat modeling, and secure coding guidance. |
| metadata | {"clawdbot":{"requires":{"env":[]}}} |
| user-invocable | true |
Comprehensive security assessment framework.
Categorize threats by type:
| Threat | Description | Example |
|---|---|---|
| Spoofing | Impersonating something/someone | Fake login page |
| Tampering | Modifying data/code | SQL injection |
| Repudiation | Denying actions | Missing audit logs |
| Information Disclosure | Exposing data | Error message leaks |
| Denial of Service | Disrupting availability | Resource exhaustion |
| Elevation of Privilege | Gaining unauthorized access | Broken access control |
Check for common vulnerabilities:
Rate vulnerability severity:
| Score | Severity | Action |
|---|---|---|
| 9.0-10.0 | Critical | Fix immediately |
| 7.0-8.9 | High | Fix within days |
| 4.0-6.9 | Medium | Fix within weeks |
| 0.1-3.9 | Low | Fix when convenient |
Identify all entry points:
For each entry point, check all STRIDE categories.
Verify protection against Top 10.
Apply CVSS to findings.
Prioritize fixes by severity.
## Security Analysis: [Component/Feature]
### Attack Surface
| Entry Point | Type | Trust Level |
|-------------|------|-------------|
| [endpoint] | API | Untrusted |
| [input] | User | Untrusted |
### STRIDE Assessment
#### Spoofing
- Risk: [description]
- Mitigation: [control]
- Status: [Mitigated/Open]
#### Tampering
...
### OWASP Top 10 Check
| Category | Status | Notes |
|----------|--------|-------|
| A01 Broken Access Control | ✓/✗ | |
| A02 Crypto Failures | ✓/✗ | |
| A03 Injection | ✓/✗ | |
...
### Vulnerabilities Found
| ID | Description | CVSS | Severity |
|----|-------------|------|----------|
| V1 | [description] | X.X | High |
| V2 | [description] | X.X | Medium |
### Remediation Plan
1. **[V1]**: [fix] - Priority: Immediate
2. **[V2]**: [fix] - Priority: This sprint
### Security Posture
**Overall Risk: [Low/Medium/High/Critical]**
For rapid review:
# Always validate and sanitize
def process_input(user_input):
if not isinstance(user_input, str):
raise ValueError("Invalid input type")
if len(user_input) > MAX_LENGTH:
raise ValueError("Input too long")
sanitized = escape_html(user_input)
return sanitized
# NEVER concatenate
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}") # BAD
# ALWAYS parameterize
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,)) # GOOD