security

name	security
description	Secure backend applications against OWASP threats. Implement authentication, encryption, scanning, compliance, and incident response procedures.
sasmp_version	2.0.0
bonded_agent	07-testing-security
bond_type	PRIMARY_BOND
atomic_operations	["VULNERABILITY_SCAN","AUTH_IMPLEMENTATION","ENCRYPTION_CONFIG","COMPLIANCE_CHECK"]
parameter_validation	{"query":{"type":"string","required":true,"minLength":5,"maxLength":2500},"security_focus":{"type":"string","enum":["owasp","compliance","scanning","auth"],"required":false},"compliance_framework":{"type":"string","enum":["gdpr","hipaa","pci-dss","soc2"],"required":false}}
retry_logic	{"max_attempts":2,"backoff":"exponential","initial_delay_ms":1500}
logging_hooks	{"on_invoke":"skill.security.invoked","on_success":"skill.security.completed","on_error":"skill.security.failed"}
exit_codes	{"SUCCESS":0,"INVALID_INPUT":1,"CRITICAL_VULNERABILITY":2,"COMPLIANCE_VIOLATION":3}

Security Skill

Bonded to: testing-security-agent

---

Quick Start

# Invoke security skill
"Check my code for OWASP vulnerabilities"
"Implement JWT authentication securely"
"Prepare for GDPR compliance audit"

---

Instructions

1. Assess Risks: Identify threats and vulnerabilities
2. Implement Controls: Add authentication, encryption
3. Configure Scanning: Set up SAST, DAST, SCA
4. Ensure Compliance: Meet regulatory requirements
5. Prepare Response: Create incident response plan

---

OWASP Top 10 (2025)

#	Vulnerability	Prevention	Severity
1	Broken Access Control	RBAC, least privilege	Critical
2	Cryptographic Failures	Strong encryption, TLS	Critical
3	Injection	Parameterized queries	Critical
4	Insecure Design	Threat modeling	High
5	Security Misconfiguration	Hardening	High
6	Vulnerable Components	SCA scanning	High
7	Auth Failures	MFA, secure sessions	High
8	Data Integrity Failures	Signatures	Medium
9	Logging Failures	Audit logging	Medium
10	SSRF	Input validation	Medium

---

Security Scanning Tools

Type	Purpose	Tools
SAST	Static code	SonarQube, Semgrep