Security & Testing Agent Skills

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring…

Use when implementing any feature or bugfix, before writing implementation code

Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise.

The TDD discipline: seams, the red → green loop, and the anti-patterns to delete.

Audits repository security — hardcoded secrets, dependency vulnerabilities, environment variable management, and authentication patterns.

Comprehensive security and correctness audit of a branch's changes.

Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners.

Run Semgrep static analysis scan on a codebase using parallel subagents.

Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.

Use when a repository, system, or major change needs a structured STRIDE-A threat model — map architecture, data flows, trust boundaries…

Generate a STRIDE-based security threat model for a repository.

Repository-grounded threat modeling. Enumerates trust boundaries, assets, attacker capabilities, and abuse paths tied to actual code. Not…

Generate threat models using STRIDE, PASTA, or VAST methodologies

When to activate: threat modeling, STRIDE, PASTA, attack tree, DFD, security design review, threat analysis

Use to work out what a system needs to be protected against — when starting a new project, before making an architectural decision, or…

Skill for the Threats_modules area of Securacy. 26 symbols across 5 files.

Protects your codebase by adding deterministic pre-action gates and safety enforcement to AI coding agents.

Toolcraft: use to verify generated apps in a real local browser after implementation.

Toolcraft: use before fixing broken controls, tests, builds, visual mismatches, exports, or runtime regressions.

Audit the active toolguard permission configuration for security risks and flag dangerous allow rules and takeover-mode misconfigurations…

Tests and evaluates any Claude Code skill for structural validity, quality, and trigger accuracy.