Security Audit and Threat Modeling

security

Security Audit and Threat Modeling is a Claude Code skill that audits a project as a chief security officer and produces a report of vulnerabilities, their severity and a remediation plan without changing code. Tasks: 'check the project for vulnerabilities', 'I need a threat model', 'did keys leak into git', 'are our CI pipelines safe'. Phases: stack and architecture model, attack surface, secrets in git history, dependency supply chain, CI/CD, forgotten infrastructure (Docker, Terraform, Kubernetes), webhooks, LLM feature security, scanning of third-party skills, OWASP Top 10, STRIDE, data classification. Two modes: daily with an 8 out of 10 confidence gate and comprehensive with a 2 out of 10 gate. False positives are filtered by explicit rules, independent sub-tasks recheck findings, each has an exploit scenario, and results are compared with the previous run. Flags like --infra, --code and --diff narrow the scope. It does not replace a penetration test.