security-deep
Use for security audits, vulnerability analysis, threat modeling, compliance, and incident response. Triggers on OWASP, XSS, SQL injection, CSRF, security audit, penetration testing, pen test, CVE, vulnerability, threat model, security review, SOC2, GDPR, PCI-DSS, HIPAA, compliance audit, CSP headers, HSTS, CORS policy, RBAC, ABAC, key rotation, encryption, AES-256, TLS, mTLS, bcrypt, argon2, Semgrep, OWASP ZAP, Snyk, Trivy, SBOM, container hardening, supply chain security, Cosign, SLSA, incident response, security posture, HashiCorp Vault, key management.
소스 정보
- 저장소
- george11642/george-plugins
- 최근 소스 활동
- 2026년 3월 11일 22:42
- 감지된 SKILL.md 언어
- 영어
- 스타
- 2
- 포크
- 0
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
파일 탐색기
11 개 파일SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- security-deep
- description
- Use for security audits, vulnerability analysis, threat modeling, compliance, and incident response. Triggers on OWASP, XSS, SQL injection, CSRF, security audit, penetration testing, pen test, CVE, vulnerability, threat model, security review, SOC2, GDPR, PCI-DSS, HIPAA, compliance audit, CSP headers, HSTS, CORS policy, RBAC, ABAC, key rotation, encryption, AES-256, TLS, mTLS, bcrypt, argon2, Semgrep, OWASP ZAP, Snyk, Trivy, SBOM, container hardening, supply chain security, Cosign, SLSA, incident response, security posture, HashiCorp Vault, key management.
# Application Security (Deep)
Deep security skill for architecture-level security decisions: auth design, cryptography, compliance, tooling, and incident response. Basic security checks (parameterized queries, no hardcoded secrets, input validation) belong in convention-check hooks -- this skill covers the WHY and HOW of security engineering.
## Task Router
| Task | Reference |
|------|-----------|
| OWASP Top 10, injection, broken auth, crypto failures | [references/owasp-top10.md](references/owasp-top10.md) |
| JWT, OAuth2/OIDC, session mgmt, RBAC/ABAC, MFA | [references/authentication-authorization.md](references/authentication-authorization.md) |
| AES-GCM, RSA, TLS config, Vault, key lifecycle | [references/cryptography-secrets.md](references/cryptography-secrets.md) |
| Input validation, SQLi, XSS, CSRF, SSRF, file upload | [references/secure-coding-patterns.md](references/secure-coding-patterns.md) |
| Semgrep, Bandit, ESLint security, ZAP, Snyk, Trivy | [references/sast-dast-tools.md](references/sast-dast-tools.md) |
| CSP, HSTS, CORS, cookie flags, rate limiting | [references/security-headers-hardening.md](references/security-headers-hardening.md) |
| API auth, rate limiting, GraphQL, gRPC, error leakage | [references/api-security.md](references/api-security.md) |
| SOC2, GDPR, PCI-DSS, HIPAA, ISO 27001 | [references/compliance-frameworks.md](references/compliance-frameworks.md) |
| Credential leak, data breach, RCE, CVE, post-mortem | [references/incident-response.md](references/incident-response.md) |
| Container hardening, Cosign, SLSA, SBOM, supply chain | [references/container-supply-chain.md](references/container-supply-chain.md) |
## When to Use This Skill
- Designing auth/authz architecture for a new system
- Choosing encryption algorithms or key management strategy
- Setting up SAST/DAST pipeline in CI/CD
- Preparing for SOC2/GDPR/PCI-DSS compliance audit
- Responding to a security incident or CVE
- Hardening container images and supply chain
- Reviewing API security posture
- Threat modeling a new feature
## Core Principles
1. **Defense in depth** -- layer multiple independent controls; never rely on one
2. **Least privilege** -- minimum permissions for every component
3. **Fail securely** -- deny access on error, not grant it
4. **Assume breach** -- design for detection and containment, not just prevention
5. **Security by default** -- secure config is the default; developers opt OUT, not IN
6. **Complete mediation** -- check authorization on every access, not just login
## CVSS Severity Quick Reference
| Score | Severity | Patch SLA | Examples |
|-------|----------|-----------|---------|
| 9.0-10.0 | Critical | 24h (4h if exploited) | RCE, SQLi with full DB access, auth bypass |
| 7.0-8.9 | High | 7 days | Stored XSS, privilege escalation, SSRF |
| 4.0-6.9 | Medium | 30 days | Reflected XSS, CSRF, info disclosure |
| 0.1-3.9 | Low | 90 days | Open redirect, verbose errors |
## Layer 3 Skills
- **auth-clerk** — Clerk authentication and authorization setup
- **monitoring-sentry** — Security incident monitoring via Sentry
GitHub에서 보기