New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Senior Security

by alirezarezvani in alirezarezvani/claude-skills

A skill your agent uses when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the…

MITAuto-check passedSecurity

Install Senior Security

skills CLI
$ npx skills add alirezarezvani/claude-skills --skill senior-security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install alirezarezvani/claude-skills senior-security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/alirezarezvani/claude-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/engineering-team/skills/senior-security .claude/skills/senior-security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
senior-security
GitHub stars
28k
Token cost
~1.3k tokens
SKILL.md length
492 words
Files
6 (incl. scripts, references)
Skills in repo
342
Repo updated
First seen
Licence
MIT

At a glance

A skill your agent uses when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the…

  • Works in 5 steps: Scope: assets to protect, trust… → Generate the threat model per component → Consume the output: sort threats.json by… → …
  • The user asks for STRIDE threat modeling
  • SKILL.md covers Routing Table (read this first), What This Skill Owns: STRIDE… and References (load on demand)
  • Runs Python scripts from its folder; calls python3

What it does

Senior Security is an agent skill from alirezarezvani/claude-skills. Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist skill (pen-testing, incident response, cloud posture, red team, AI security, threat hunting, secure code review). This skill owns threat modeling; everything else routes to a sibling.

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts and reference files (for example `references/cryptography-implementation.md`, `references/security-architecture-patterns.md` and `references/threat-modeling-guide.md`).

It sits in Security, covering Threat modeling and Incident response. The repository describes itself as: 380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8… The licence is MIT.

When your agent uses it

  • The user asks for STRIDE threat modeling
  • DREAD risk scoring
  • Data-flow-diagram threat analysis
  • A quick secret scan —

Example prompts

  • “/senior-security”

Requirements

  • Python 3

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Scope: assets to protect, trust boundaries, data flows (external entities, processes, data stores, flows).
  2. Generate the threat model per component
  3. Consume the output: sort threats.json by DREAD score descending; everything ≥ 7 average needs a named mitigation owner before the design…
  4. Quick secret sweep while you have the codebase open
  5. Verification gate: every DFD element has ≥ 1 STRIDE row considered, every threat with DREAD ≥ 7 has an owner + mitigation, and the secret…

What it can do on your machine

Read from SKILL.md and the folder at commit 19392f7. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Senior Security loads about 1.3k tokens when it runs, and up to ~18k if it reads all its reference files. Until then it costs about 99 tokens; SKILL.md has 492 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~99
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~18k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from alirezarezvani/claude-skills at commit 19392f7, republished under its MIT licence (© alirezarezvani). 492 words, ~1,287 tokens.

Download SKILL.mdSave it as .claude/skills/senior-security/SKILL.md (or your agent's skills folder). This skill also uses 5 other files; get the full folder from GitHub.
name
senior-security
description
Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist skill (pen-testing, incident response, cloud posture, red team, AI security, threat hunting, secure code review). This skill owns threat modeling; everything else routes to a sibling.

Senior Security Engineer — Threat Modeling + Security Router

This skill does exactly one job itself — STRIDE/DREAD threat modeling (plus a quick secret scan) — and routes every other security request to the specialist skill that owns that lane. Do not duplicate sibling content here; route instead.

Routing Table (read this first)

The user wants...Route toWhy that skill owns it
Vulnerability assessment, pen-test methodology, OWASP Top 10 testing../security-pen-testing/Ships vulnerability_scanner.py + dependency_auditor.py with exit-code contracts
Incident triage, SEV classification, forensics, containment../incident-response/SEV1–SEV4 taxonomy, NIST SP 800-61 phases, incident_triage.py
Production outage command (non-security incidents)../incident-commander/Severity classifier + timeline + postmortem tools
Security monitoring, CVE triage SLAs, compliance checks (SOC 2 etc.), security headers../senior-secops/security_scanner.py + compliance_checker.py, CVE SLA table
Hostile/adversarial code review../adversarial-reviewer/3-persona review with BLOCK/CONCERNS/CLEAN verdict
Secure code review as part of general review../code-reviewer/Language dispatch + regression fixtures
Cloud IAM escalation paths, S3 exposure, security groups../cloud-security/cloud_posture_check.py with per-check exit codes
Threat hunting, IOC sweeps, anomaly detection../threat-detection/z-score anomaly + IOC staleness tooling
Red-team engagement planning, ATT&CK kill chains../red-team/engagement_planner.py with authorization gate
LLM/AI attack surface (prompt injection, poisoning)../ai-security/ATLAS-mapped ai_threat_scanner.py

If the request spans lanes (e.g., "secure this new architecture"), do the threat model here first — its output (prioritized threats + mitigations) tells you which siblings to load next. Never bulk-load multiple security skills speculatively.

What This Skill Owns: STRIDE Threat Modeling

Workflow
  1. Scope: assets to protect, trust boundaries, data flows (external entities, processes, data stores, flows).
  2. Generate the threat model per component:
    bash
    python3 scripts/threat_modeler.py --component "User Authentication" --assets "credentials,sessions" --json --output threats.json
    Output: per-threat STRIDE category, DREAD score (Damage, Reproducibility, Exploitability, Affected users, Discoverability — each 1–10), and suggested mitigations. Repeat per DFD element; --interactive walks scoping questions; --list-threats shows the threat database.
  3. Consume the output: sort threats.json by DREAD score descending; everything ≥ 7 average needs a named mitigation owner before the design ships. Map each mitigation to the responsible sibling lane (e.g., IAM threats → cloud-security, injection threats → code-reviewer).
  4. Quick secret sweep while you have the codebase open:
    bash
    python3 scripts/secret_scanner.py /path/to/project --format json --severity high
    20+ patterns (AWS keys, GitHub tokens, private keys, generic credentials). Any critical/high finding blocks merge until rotated and moved to a secret manager.
  5. Verification gate: every DFD element has ≥ 1 STRIDE row considered, every threat with DREAD ≥ 7 has an owner + mitigation, and the secret scan exits with zero high/critical findings. Re-run both tools after mitigations land — that re-run is the done signal, not the document.
Show full SKILL.md (99 more words)Show less
STRIDE per Element Matrix
DFD ElementSTRIDE
External EntityXX
ProcessXXXXXX
Data StoreXXXX
Data FlowXXX

(S=Spoofing→authn, T=Tampering→integrity, R=Repudiation→audit logs, I=Info Disclosure→encryption/access control, D=DoS→rate limiting/redundancy, E=Elevation→least privilege.)

References (load on demand)

DocumentContent
references/threat-modeling-guide.mdSTRIDE methodology, attack trees, DREAD scoring, DFD creation
references/security-architecture-patterns.mdZero Trust, defense-in-depth, authentication patterns, API security
references/cryptography-implementation.mdAES-GCM, Ed25519, password hashing (Argon2id), key management

The architecture and crypto references are kept because no sibling ships them; for operating those controls (scanning, compliance, monitoring) still route to senior-secops.

© alirezarezvani, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (scripts, references) in engineering-team/skills/senior-security of alirezarezvani/claude-skills.

  • SKILL.md
  • references/cryptography-implementation.md
  • references/security-architecture-patterns.md
  • references/threat-modeling-guide.md
  • scripts/secret_scanner.py
  • scripts/threat_modeler.py

Open the folder on GitHubat commit 19392f7

Compare with similar skills

Senior Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Senior Security compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Senior Security this skillalirezarezvani/claude-skills28k—~1.3kAutomated safety check: PassMIT
Forensifyalexgreensh/repo-forensics188—~2.5kAutomated safety check: NotesCustom licence
Together Security Basicsjeremylongshore/tons-of-skills-marketplace2.8k—~1kAutomated safety check: PassMIT
007sickn33/agentic-awesome-skills47k2 repos~410Automated safety check: PassMIT
Clickup Security Basicsjeremylongshore/tons-of-skills-marketplace2.8k—~1kAutomated safety check: PassMIT
Fla Ascend Performancefla-org/flash-linear-attention5.8k—~6.3kAutomated safety check: PassMIT

Similar skills

  • Forensify

    alexgreensh/repo-forensics

    Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

    188 GitHub stars~2.5k tokensUpdated 11 days ago
    SecurityAuto-check: notes

  • Together Security Basics

    jeremylongshore/tons-of-skills-marketplace

    Secure Together AI integrations with project-scoped keys, environment isolation, prompt/output data controls, bounded model behavior, safe logging, rotation, and incident response.

    2.8k GitHub stars~1k tokensUpdated today
    SecurityAuto-check passed

  • 007

    sickn33/agentic-awesome-skills

    Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

    47k GitHub starsUsed in 2 repos~410 tokens
    SecurityAuto-check passed

  • Clickup Security Basics

    jeremylongshore/tons-of-skills-marketplace

    Harden ClickUp credentials, OAuth callbacks, Workspace boundaries, webhooks, logging, and incident response with least-privilege controls.

    2.8k GitHub stars~1k tokensUpdated today
    Backend & APIsAuto-check passed

  • Fla Ascend Performance

    fla-org/flash-linear-attention

    Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.

    5.8k GitHub stars~6.3k tokensUpdated today
    SecurityAuto-check passed

  • Create Rule

    cartography-cncf/cartography

    Author a Cartography security rule (one or more Cypher Facts plus a Pydantic Finding output model) under cartography/rules/data/rules/.

    4.1k GitHub stars~3k tokensUpdated today
    SecurityAuto-check passed

More from alirezarezvani/claude-skills

All 342 skills in this repo

  • Agile Product Owner

    alirezarezvani/claude-skills

    Writes INVEST-checked user stories with acceptance criteria, splits epics, plans sprints from velocity and ranks the backlog with a weighted score.

    28k GitHub starsUsed in 3 repos~3.2k tokens
    Auto-check passed

  • Product Strategist

    alirezarezvani/claude-skills

    OKR cascade toolkit for product leaders: generates aligned company-to-team OKRs from five strategy types and scores how well they line up.

    28k GitHub starsUsed in 2 repos~1.8k tokens
    Auto-check passed

  • App Store Optimization

    alirezarezvani/claude-skills

    App Store Optimization (ASO) toolkit for researching keywords, analyzing competitor rankings, generating metadata suggestions, and improving app visibility on Apple App Store and Google Play Store.

    28k GitHub starsUsed in 1 repo~4.2k tokens
    Auto-check passed

  • AWS Solution Architect

    alirezarezvani/claude-skills

    Design AWS architectures for startups using serverless patterns and IaC templates.

    28k GitHub starsUsed in 1 repo~2.5k tokens
    Auto-check passed

  • Campaign Analytics

    alirezarezvani/claude-skills

    Calculates attribution, funnel and ROI figures for marketing campaigns with three Python scripts that need only the standard library.

    28k GitHub starsUsed in 1 repo~2.1k tokens
    Auto-check passed

  • Code to PRD

    alirezarezvani/claude-skills

    Reverse-engineers a frontend, backend or fullstack codebase into a product requirements document with per-page docs, an enum dictionary and an API inventory.

    28k GitHub starsUsed in 1 repo~4.9k tokens
    Auto-check passed

Categories

Questions about Senior Security

What does Senior Security do?

A skill your agent uses when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the…. Senior Security is an agent skill from alirezarezvani/claude-skills. Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist skill (pen-testing, incident response, cloud posture, red team, AI security, threat hunting, secure code review).

When should I use Senior Security?

Senior Security fits situations like: the user asks for STRIDE threat modeling; DREAD risk scoring; data-flow-diagram threat analysis; A quick secret scan —.

How do I install Senior Security in Claude Code?

Run `npx skills add alirezarezvani/claude-skills --skill senior-security -a claude-code`. Or copy the skill folder (engineering-team/skills/senior-security in alirezarezvani/claude-skills) into .claude/skills/senior-security in your project. Claude Code loads it when a task matches its description.

How do I install Senior Security in Codex?

Run `npx skills add alirezarezvani/claude-skills --skill senior-security -a codex`. Or copy the skill folder (engineering-team/skills/senior-security in alirezarezvani/claude-skills) into .agents/skills/senior-security in your project. Codex loads it when a task matches its description.

Can I use Senior Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add alirezarezvani/claude-skills --skill senior-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/senior-security, .gemini/skills/senior-security, .github/skills/senior-security and .opencode/skills/senior-security in your project.

What does Senior Security need to run?

Going by SKILL.md and its folder, Senior Security needs Python for the scripts in its folder and the command-line tools its instructions call (python3). Our summary lists: Python 3.

Does Senior Security access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Senior Security safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Senior Security use?

Senior Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Senior Security use?

About 1.3k tokens (SKILL.md is roughly 5.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 17k tokens, read only when the agent opens those files.

What are the alternatives to Senior Security?

Skills that share tags, products or a category with Senior Security: Forensify (alexgreensh/repo-forensics, 188 stars), Together Security Basics (jeremylongshore/tons-of-skills-marketplace, 2.8k stars), 007 (sickn33/agentic-awesome-skills, 47k stars) and Clickup Security Basics (jeremylongshore/tons-of-skills-marketplace, 2.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Senior Security?

alirezarezvani (a GitHub user) maintains it in alirezarezvani/claude-skills, which has 27,829 GitHub stars. The repository holds 342 skills in this directory. The repository was last updated on August 30, 2026.

Source: alirezarezvani/claude-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.