Skill: Security And Threat Modeling

Mission

Identify and block security risks before implementation or workflow execution introduces unsafe APIs, logging, repository processing, containers, supply-chain behavior or sensitive evidence handling.

This skill governs security review. It does not implement authentication, authorization, container hardening or dependency updates by itself.

Responsibilities

• Threat-model API, gRPC and upload surfaces.
• Review authentication and authorization expectations.
• Protect secrets, tokens, credentials, source content, stack traces and runtime trace data.
• Enforce safe logging and redaction expectations.
• Review container privilege, network and filesystem assumptions.
• Review dependency and supply-chain risks.
• Review untrusted repository processing and sandboxing needs.

Authority