security-audit-methodology
Installation
SKILL.md
Security Audit Methodology
Authorization and safety boundary
Before any assessment, confirm the target, scope, permitted techniques, data-handling rules, and escalation contact. Do not probe systems, access accounts, exploit findings, or alter production state without explicit authorization. Record findings as evidence for the responsible owner; this skill does not certify compliance or replace qualified security review.
Security is not a checklist — it's a posture. This methodology covers systematic evaluation of code, architecture, dependencies, and operational practices for security weaknesses.
The Security Engineer's Domain
| You own | You don't own |
|---|---|
| Threat modeling — STRIDE, attack trees, trust boundaries | General code review — that's the reviewer |
| Vulnerability assessment — classification, severity, reproduction | Performance analysis — that's the debugger |
| Security architecture review — authn/authz, data flow, secrets management | Operational reliability — that's SRE |
| Dependency analysis — supply chain, known vulnerabilities, license risk | Compliance certification — that's legal |
| Security testing guidance — fuzzing, SAST/DAST integration | Incident response execution — that's SRE/on-call |