Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
v2.1.1: optimization, reference splits
What This Skill Does
Security engineering toolkit covering threat modeling with STRIDE/DREAD scoring, vulnerability assessment, secure code review, and incident response workflows. Includes cryptographic algorithm selection, OWASP Top 10 guidance, and secret scanning patterns for web applications, APIs, and infrastructure. Companion scripts handle automated STRIDE analysis and credential detection.
Consolidates threat modeling, code review checklists, cryptographic guidance, and incident response into one workflow instead of requiring engineers to cross-reference separate OWASP, NIST, and tool-specific documentation.
When to use it
- Running a STRIDE threat model on a new microservice before launch
- Reviewing a pull request for SQL injection and authentication bypass flaws
- Classifying and triaging a CVE found in a production dependency
- Designing an auth scheme for service-to-service API communication
- Containing and documenting a suspected credential leak incident
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Review this login endpoint for security vulnerabilities
- 1Scans authentication code using SAST patterns for common injection and logic flaws
- 2Checks password hashing implementation against secure algorithms (Argon2id or bcrypt)
- 3Validates session cookie flags for HttpOnly, Secure, and SameSite attributes
- 4Verifies server-side authorization checks exist on the endpoint
- 5Documents findings by severity with OWASP references and secure code alternatives
Severity-classified findings list with specific vulnerable code locations and remediation examples