home / skills / benchflow-ai / skillsbench / senior-security

senior-security skill

needs review

/tasks/fix-erlang-ssh-cve/environment/skills/senior-security

This skill helps secure applications through threat modeling, security auditing, and automated pentesting, delivering actionable guidance and fixes.

This is most likely a fork of the senior-security skill from questnova502

npx playbooks add skill benchflow-ai/skillsbench --skill senior-security

Review the files below or copy the command above to add this skill to your agents.

Files (7)

SKILL.md

4.4 KB

---
name: senior-security
description: Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
---

# Senior Security

Complete toolkit for senior security with modern tools and best practices.

## Quick Start

### Main Capabilities

This skill provides three core capabilities through automated scripts:

```bash
# Script 1: Threat Modeler
python scripts/threat_modeler.py [options]

# Script 2: Security Auditor
python scripts/security_auditor.py [options]

# Script 3: Pentest Automator
python scripts/pentest_automator.py [options]
```

## Core Capabilities

### 1. Threat Modeler

Automated tool for threat modeler tasks.

**Features:**
- Automated scaffolding
- Best practices built-in
- Configurable templates
- Quality checks

**Usage:**
```bash
python scripts/threat_modeler.py <project-path> [options]
```

### 2. Security Auditor

Comprehensive analysis and optimization tool.

**Features:**
- Deep analysis
- Performance metrics
- Recommendations
- Automated fixes

**Usage:**
```bash
python scripts/security_auditor.py <target-path> [--verbose]
```

### 3. Pentest Automator

Advanced tooling for specialized tasks.

**Features:**
- Expert-level automation
- Custom configurations
- Integration ready
- Production-grade output

**Usage:**
```bash
python scripts/pentest_automator.py [arguments] [options]
```

## Reference Documentation

### Security Architecture Patterns

Comprehensive guide available in `references/security_architecture_patterns.md`:

- Detailed patterns and practices
- Code examples
- Best practices
- Anti-patterns to avoid
- Real-world scenarios

### Penetration Testing Guide

Complete workflow documentation in `references/penetration_testing_guide.md`:

- Step-by-step processes
- Optimization strategies
- Tool integrations
- Performance tuning
- Troubleshooting guide

### Cryptography Implementation

Technical reference guide in `references/cryptography_implementation.md`:

- Technology stack details
- Configuration examples
- Integration patterns
- Security considerations
- Scalability guidelines

## Tech Stack

**Languages:** TypeScript, JavaScript, Python, Go, Swift, Kotlin
**Frontend:** React, Next.js, React Native, Flutter
**Backend:** Node.js, Express, GraphQL, REST APIs
**Database:** PostgreSQL, Prisma, NeonDB, Supabase
**DevOps:** Docker, Kubernetes, Terraform, GitHub Actions, CircleCI
**Cloud:** AWS, GCP, Azure

## Development Workflow

### 1. Setup and Configuration

```bash
# Install dependencies
npm install
# or
pip install -r requirements.txt

# Configure environment
cp .env.example .env
```

### 2. Run Quality Checks

```bash
# Use the analyzer script
python scripts/security_auditor.py .

# Review recommendations
# Apply fixes
```

### 3. Implement Best Practices

Follow the patterns and practices documented in:
- `references/security_architecture_patterns.md`
- `references/penetration_testing_guide.md`
- `references/cryptography_implementation.md`

## Best Practices Summary

### Code Quality
- Follow established patterns
- Write comprehensive tests
- Document decisions
- Review regularly

### Performance
- Measure before optimizing
- Use appropriate caching
- Optimize critical paths
- Monitor in production

### Security
- Validate all inputs
- Use parameterized queries
- Implement proper authentication
- Keep dependencies updated

### Maintainability
- Write clear code
- Use consistent naming
- Add helpful comments
- Keep it simple

## Common Commands

```bash
# Development
npm run dev
npm run build
npm run test
npm run lint

# Analysis
python scripts/security_auditor.py .
python scripts/pentest_automator.py --analyze

# Deployment
docker build -t app:latest .
docker-compose up -d
kubectl apply -f k8s/
```

## Troubleshooting

### Common Issues

Check the comprehensive troubleshooting section in `references/cryptography_implementation.md`.

### Getting Help

- Review reference documentation
- Check script output messages
- Consult tech stack documentation
- Review error logs

## Resources

- Pattern Reference: `references/security_architecture_patterns.md`
- Workflow Guide: `references/penetration_testing_guide.md`
- Technical Guide: `references/cryptography_implementation.md`
- Tool Scripts: `scripts/` directory

Overview

This skill delivers a comprehensive security engineering toolkit for senior engineers focused on application security, penetration testing, security architecture, and compliance auditing. It packages automated threat modeling, deep security audits, and pentest automation together with practical references for cryptography and architecture patterns. Use it to accelerate assessments, enforce best practices, and produce actionable remediation steps.

How this skill works

The skill exposes three automated scripts: a Threat Modeler to scaffold and validate threat models, a Security Auditor to perform deep static and configuration analysis with recommendations and automated fixes, and a Pentest Automator to run targeted penetration workflows and integrations. Each tool uses configurable templates and quality checks, integrates into CI/CD, and outputs structured findings and remediation guidance. Reference guides provide architecture patterns, penetration workflows, and cryptography implementation details for manual review and customization.

When to use it

Designing or reviewing application security architecture for new or existing systems
Running regular security audits or automated checks as part of CI/CD
Preparing for or executing a penetration test with repeatable automation
Implementing or validating cryptographic components and key management
Hardening production deployments and validating remediation effectiveness

Best practices

Run threat modeling early and iterate as design changes; store templates with the project
Integrate the security auditor into CI pipelines to catch regressions automatically
Use parameterized configurations to avoid secret leakage and enable environment-specific checks
Prioritize findings by risk and exploitability; automate low-risk fixes and document manual remediations
Keep dependencies and toolchains updated and validate cryptography against current standards

Example use cases

Generate a threat model for a new microservices system and export actionable mitigations
Execute an automated security audit on a repository and apply automated fixes where safe
Orchestrate a pentest run across multiple targets and produce a consolidated findings report
Validate TLS and key management configurations against recommended cryptography patterns
Add security gates to CI that block merges on high-severity findings

FAQ

Can the scripts integrate with CI/CD?

Yes. The tools are designed to run in CI environments and produce machine-readable output for pipelines and dashboards.

Are automated fixes safe to apply?

Automated fixes cover low-risk, deterministic issues. Review and test any automated change in staging before applying to production.

How customizable are the templates and checks?

Templates and quality checks are configurable; you can extend patterns, add custom rules, and adapt recommendations to your organization.