Security Architect Skill

Step 1: Threat Modeling (STRIDE)

Step 2: OWASP Top 10 Analysis

1. A01: Broken Access Control
   • Verify authorization on every endpoint
   • Deny by default
2. A02: Cryptographic Failures
   • Use strong algorithms (AES-256, SHA-256+)
   • Never store plaintext passwords
3. A03: Injection
   • Parameterize all queries
   • Validate/sanitize inputs
4. A04: Insecure Design
   • Threat model early
   • Use secure design patterns
5. A05: Security Misconfiguration
   • Harden defaults
   • Remove unnecessary features
6. A06: Vulnerable Components
   • Keep dependencies updated
   • Monitor CVE databases
7. A07: Authentication Failures
   • Implement MFA
   • Use secure session management
8. A08: Software/Data Integrity
   • Verify dependencies (SRI, signatures)
   • Protect CI/CD pipelines
9. A09: Logging Failures
   • Log security events
   • Protect log integrity
10. A10: SSRF
    • Validate/sanitize URLs
    • Use allowlists

Step 3: Security Code Review

// BAD: SQL Injection
const query = `SELECT * FROM users WHERE id = ${userId}`;

// GOOD: Parameterized query
const query = `SELECT * FROM users WHERE id = $1`;
await db.query(query, [userId]);

// BAD: Hardcoded secrets
const apiKey = 'sk-abc123...';

// GOOD: Environment variables
const apiKey = process.env.API_KEY;

Step 4: Authentication/Authorization Review

• Strong password requirements
• Secure session management
• JWT validation (signature, expiry, audience)
• Role-based access control (RBAC)
• API authentication (OAuth 2.0, API keys)

Step 5: Generate Security Report

## Security Assessment Report

### Critical Findings

1. SQL injection in /api/users endpoint
   - Risk: Data breach
   - Fix: Use parameterized queries

### High Findings

2. Missing rate limiting on login
   - Risk: Brute force attacks
   - Fix: Implement rate limiting

### Recommendations

- Enable HTTPS everywhere
- Implement CSP headers
- Add security logging

1. Defense in Depth: Layer security controls
2. Least Privilege: Minimal permissions
3. Fail Securely: Default to deny
4. Validate Everything: Never trust input
5. Keep Secrets Secret: Use secret managers

Review the authentication flow in src/auth/ for security issues

## Security Review: src/auth/

### Findings

#### CRITICAL: Weak Password Hashing

- File: src/auth/password.js:23
- Issue: Using MD5 for password hashing
- Fix: Use bcrypt with cost factor >= 12

#### HIGH: No Rate Limiting

- File: src/auth/login.js
- Issue: Login endpoint has no rate limiting
- Fix: Add rate limiting (5 attempts/minute)

#### MEDIUM: Session Not Invalidated

- File: src/auth/logout.js
- Issue: Logout doesn't invalidate server-side session
- Fix: Clear session from store on logout

### Recommendations

1. Implement bcrypt for password hashing
2. Add rate limiting middleware
3. Use secure session configuration

Rules

• Always prioritize findings by severity
• Provide specific remediation steps
• Consider business context when assessing risk

Related Skills

• auth-security-expert

  - OAuth 2.1, JWT, and authentication-specific security patterns

Related Workflow

• Workflow File:

  .claude/workflows/security-architect-skill-workflow.md

• When to Use: For structured security audits requiring OWASP Top 10 analysis, dependency CVE checks, penetration testing, and remediation planning
• Phases: 5 phases (Threat Modeling, Security Code Review, Dependency Audit, Penetration Testing, Remediation Planning)
• Coverage: Full OWASP Top 10, STRIDE threat modeling, CVE database checks, automated and manual penetration testing

• Multi-agent orchestration (security-architect, code-reviewer, developer, devops)
• Security gates for pre-release blocking
• Severity classification (CRITICAL/HIGH/MEDIUM/LOW)
• Automated ticket generation
• Compliance-ready reporting (SOC2, GDPR, HIPAA)

Memory Protocol (MANDATORY)

cat .claude/context/memory/learnings.md

• New pattern ->

  .claude/context/memory/learnings.md

• Issue found ->

  .claude/context/memory/issues.md

• Decision made ->

  .claude/context/memory/decisions.md

ASSUME INTERRUPTION: Your context may reset. If it's not in memory, it didn't happen.