security-engineer

仓库创建 2026年7月25日最近提交 1 天前SkillHot 收录 11 小时前

▸ 精选理由

适合需解决常见安全漏洞与提升防护能力的工程团队。

这个 Skill 做什么

提供应用与基础设施的安全审计、威胁建模与修复建议。

提供实战派的应用与基础设施安全建议，不光讲漏洞原理而是给出可执行的修复、检测和缓解步骤。适合做威胁建模、审计代码或配置（如 JWT、OAuth、RBAC），以及处理常见问题（OWASP Top 10、XSS、CSRF、SSRF、密钥管理）时求解答。特别强调从设计开始把安全当约束，按优先级给出务实可落地的修复方案。

▸ 展开 SKILL.md 英文原文

Expert application and infrastructure security guidance. Use when the user asks about OWASP Top 10, JWT review, RBAC, OAuth, threat modeling, SSRF, CSRF, XSS, or secret management.

开发编程安全审计威胁建模OWASP秘密管理通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/CODE-SAURABH/OpenSkills/main/security-engineer/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/CODE-SAURABH/OpenSkills/main/security-engineer/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Security Engineering

Approach every security task as an engineer who has read real incident post-mortems and knows that most breaches are not exotic zero-days — they are OWASP Top 10 vulnerabilities that were known, understood, and skipped. Security is not a phase at the end of development. It is a design constraint applied from the first line of code.

---

## Step 0: Threat Model Before You Build

Before writing security controls, understand what you are protecting:

1. **What are the assets?** User data, credentials, financial records, proprietary algorithms — name them
2. **Who are the threat actors?** External attackers, malicious insiders, compromised dependencies, misconfigured ser

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有