domains / security / security-engineering / senior-security

senior-security

combined

The two copies describe the same high-level domain but provide materially different procedures. The benchflow-ai copy is a wrapper around three specific Python scripts (threat_modeler.py, security_auditor.py, pentest_automator.py) and references a specific tech stack (TypeScript, React, etc.). The LeoYeAI copy provides a manual, methodology-driven workflow (STRIDE, DREAD, Defense-in-Depth) with specific tables for threat categorization and authentication patterns. Neither is a reproduction of the other; one is tool-centric and the other is process-centric.

Repositories

Repository	Path
benchflow-ai/skillsbench	`tasks/fix-erlang-ssh-cve/environment/skills/senior-security/SKILL.md`
LeoYeAI/openclaw-master-skills	`skills/senior-security/SKILL.md`

Other copies

Role	Repository	Path
peer	benchflow-ai/skillsbench	`tasks/fix-erlang-ssh-cve/environment/skills/senior-security/SKILL.md`
peer	LeoYeAI/openclaw-master-skills	`skills/senior-security/SKILL.md`

Combined skill

# Senior Security

## 1. Threat Modeling
1. **Manual Analysis (STRIDE):**
   - Define system scope and map trust boundaries.
   - Create a Data Flow Diagram (DFD).
   - Apply STRIDE to each DFD element (Process, Data Store, Data Flow, External Entity).
   - Score risks using DREAD (Damage, Reproducibility, Exploitability, Affected Users, Discoverability).
2. **Automated Scaffolding:**
   - Run `python scripts/threat_modeler.py <project-path>` to generate initial threat model scaffolding.

## 2. Security Architecture
1. **Defense-in-Depth:**
   - Implement layers: Perimeter (WAF/DDoS), Network (Segmentation/mTLS), Host (EDR/Hardening), Application (Input Validation/Auth), Data (Encryption).
   - Apply Zero Trust principles: Verify explicitly, Least privilege, Assume breach.
2. **Authentication Patterns:**
   - Web: OAuth 2.0 + PKCE.
   - API: JWT + Refresh Tokens.
   - Service-to-Service: mTLS.

## 3. Vulnerability Assessment & Auditing
1. **Automated Scanning:**
   - Run `python scripts/security_auditor.py <target-path> --verbose` for static analysis and dependency checks.
   - Run `python scripts/pentest_automator.py --analyze` for dynamic analysis and secret detection.
2. **Manual Review:**
   - Review automated findings for business logic flaws and authorization issues.
   - Classify findings by severity (Critical, High, Medium, Low).

## 4. Resources
- Reference `references/security_architecture_patterns.md` for design patterns.
- Reference `references/penetration_testing_guide.md` for testing workflows.
- Reference `references/threat-modeling-guide.md` for STRIDE details.