Security Claude — Security skill for Claude Code

security-architecture-intelligence

A Claude skill for defensive security work: architecture review, threat modeling, attack-surface and trust-boundary analysis, and verified vulnerability review — grounded in OWASP ASVS/Top 10/SAMM, NIST SSDF, and CISA Secure-by-Design guidance.

What it does

Instead of pattern-matching for suspicious strings, this skill walks Claude through the same reasoning a security architect would use:

UNDERSTAND → MAP → CLASSIFY ASSETS → TRUST BOUNDARIES → THREAT MODEL →
ATTACK SURFACE → DATA FLOWS → CONTROLS → VERIFY IN CODE → RANK RISK →
FIX → TEST → RE-AUDIT

It scales from a one-file diff review to a full-repository audit using the same underlying method, and it refuses to report a finding above "possible" confidence without tracing it to a concrete, exploitable sink.

Structure

security-architecture-intelligence/
├── SKILL.md          orchestrator — start here
├── frameworks/        summaries of OWASP/NIST/CISA standards
├── references/        deep-dive domain knowledge, loaded on demand
├── checklists/        operational verification lists
├── templates/         output shapes for reports, ADRs, gates
└── examples/          worked patterns per stack (Node, Python, React, etc.)

Install

Drop this folder into your skills directory (or upload the packaged `.zip`/`.skill`), then ask Claude things like:

• "Audit this repo for security issues"
• "Threat model our new file-upload feature"
• "Is this API endpoint vulnerable to IDOR?"
• "Are we ready to ship — run a security release gate"

Scope and limits

This is a **defensive-only** skill. It does not generate exploit code, malware, or offensive tooling, and it will say so if asked. It also refuses to guess at live secrets — only how to manage them properly.

Framework version numbers (ASVS, SSDF, etc.) were accurate as of authoring; for the latest revision, ask Claude to verify current versions via search before citing one in a formal report.

License

S