Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub ยท Developer Tools
Senior Security
Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools.
skill openclawclawhub Free
Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools.
โฌ 0 downloads โ
0 stars Unverified but indexed
Install for OpenClaw
Quick setup
- Download the package from Yavira.
- Extract the archive and review SKILL.md first.
- Import or place the package into your OpenClaw setup.
Package facts
- Download mode
- Yavira redirect
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- SKILL.md, references/cryptography-implementation.md, references/security-architecture-patterns.md, references/threat-modeling-guide.md, scripts/secret_scanner.py, scripts/threat_modeler.py
Validation
- Use the Yavira download entry.
- Review SKILL.md after the package is downloaded.
- Confirm the extracted package contains the expected setup assets.
Install with your agent
Agent handoff
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
New install
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
Upgrade existing
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 2.1.1
Provenance
- Publisher
- alirezarezvani
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
Senior Security Engineer
Security engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.
Table of Contents
Threat Modeling Workflow Security Architecture Workflow Vulnerability Assessment Workflow Secure Code Review Workflow Incident Response Workflow Security Tools Reference Tools and References
Threat Modeling Workflow
Identify and analyze security threats using STRIDE methodology.
Workflow: Conduct Threat Model
Define system scope and boundaries: Identify assets to protect Map trust boundaries Document data flows Create data flow diagram: External entities (users, services) Processes (application components) Data stores (databases, caches) Data flows (APIs, network connections) Apply STRIDE to each DFD element (see STRIDE per Element Matrix below) Score risks using DREAD: Damage potential (1-10) Reproducibility (1-10) Exploitability (1-10) Affected users (1-10) Discoverability (1-10) Prioritize threats by risk score Define mitigations for each threat Document in threat model report Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped
STRIDE Threat Categories
CategorySecurity PropertyMitigation FocusSpoofingAuthenticationMFA, certificates, strong authTamperingIntegritySigning, checksums, validationRepudiationNon-repudiationAudit logs, digital signaturesInformation DisclosureConfidentialityEncryption, access controlsDenial of ServiceAvailabilityRate limiting, redundancyElevation of PrivilegeAuthorizationRBAC, least privilege
STRIDE per Element Matrix
DFD ElementSTRIDEExternal EntityXXProcessXXXXXXData StoreXXXXData FlowXXX See: references/threat-modeling-guide.md
Security Architecture Workflow
Design secure systems using defense-in-depth principles.
Workflow: Design Secure Architecture
Define security requirements: Compliance requirements (GDPR, HIPAA, PCI-DSS) Data classification (public, internal, confidential, restricted) Threat model inputs Apply defense-in-depth layers: Perimeter: WAF, DDoS protection, rate limiting Network: Segmentation, IDS/IPS, mTLS Host: Patching, EDR, hardening Application: Input validation, authentication, secure coding Data: Encryption at rest and in transit Implement Zero Trust principles: Verify explicitly (every request) Least privilege access (JIT/JEA) Assume breach (segment, monitor) Configure authentication and authorization: Identity provider selection MFA requirements RBAC/ABAC model Design encryption strategy: Key management approach Algorithm selection Certificate lifecycle Plan security monitoring: Log aggregation SIEM integration Alerting rules Document architecture decisions Validation: Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned
Defense-in-Depth Layers
Layer 1: PERIMETER WAF, DDoS mitigation, DNS filtering, rate limiting Layer 2: NETWORK Segmentation, IDS/IPS, network monitoring, VPN, mTLS Layer 3: HOST Endpoint protection, OS hardening, patching, logging Layer 4: APPLICATION Input validation, authentication, secure coding, SAST Layer 5: DATA Encryption at rest/transit, access controls, DLP, backup
Authentication Pattern Selection
Use CaseRecommended PatternWeb applicationOAuth 2.0 + PKCE with OIDCAPI authenticationJWT with short expiration + refresh tokensService-to-servicemTLS with certificate rotationCLI/AutomationAPI keys with IP allowlistingHigh securityFIDO2/WebAuthn hardware keys See: references/security-architecture-patterns.md
Vulnerability Assessment Workflow
Identify and remediate security vulnerabilities in applications.
Workflow: Conduct Vulnerability Assessment
Define assessment scope: In-scope systems and applications Testing methodology (black box, gray box, white box) Rules of engagement Gather information: Technology stack inventory Architecture documentation Previous vulnerability reports Perform automated scanning: SAST (static analysis) DAST (dynamic analysis) Dependency scanning Secret detection Conduct manual testing: Business logic flaws Authentication bypass Authorization issues Injection vulnerabilities Classify findings by severity: Critical: Immediate exploitation risk High: Significant impact, easier to exploit Medium: Moderate impact or difficulty Low: Minor impact Develop remediation plan: Prioritize by risk Assign owners Set deadlines Verify fixes and document Validation: Scope defined; automated and manual testing complete; findings classified; remediation tracked For OWASP Top 10 vulnerability descriptions and testing guidance, refer to owasp.org/Top10.
Vulnerability Severity Matrix
Impact \ ExploitabilityEasyModerateDifficultCriticalCriticalCriticalHighHighCriticalHighMediumMediumHighMediumLowLowMediumLowLow
Secure Code Review Workflow
Review code for security vulnerabilities before deployment.
Workflow: Conduct Security Code Review
Establish review scope: Changed files and functions Security-sensitive areas (auth, crypto, input handling) Third-party integrations Run automated analysis: SAST tools (Semgrep, CodeQL, Bandit) Secret scanning Dependency vulnerability check Review authentication code: Password handling (hashing, storage) Session management Token validation Review authorization code: Access control checks RBAC implementation Privilege boundaries Review data handling: Input validation Output encoding SQL query construction File path handling Review cryptographic code: Algorithm selection Key management Random number generation Document findings with severity Validation: Automated scans passed; auth/authz reviewed; data handling checked; crypto verified; findings documented
Security Code Review Checklist
CategoryCheckRiskInput ValidationAll user input validated and sanitizedInjectionOutput EncodingContext-appropriate encoding appliedXSSAuthenticationPasswords hashed with Argon2/bcryptCredential theftSessionSecure cookie flags set (HttpOnly, Secure, SameSite)Session hijackingAuthorizationServer-side permission checks on all endpointsPrivilege escalationSQLParameterized queries used exclusivelySQL injectionFile AccessPath traversal sequences rejectedPath traversalSecretsNo hardcoded credentials or keysInformation disclosureDependenciesKnown vulnerable packages updatedSupply chainLoggingSensitive data not loggedInformation disclosure
Secure vs Insecure Patterns
PatternIssueSecure AlternativeSQL string formattingSQL injectionUse parameterized queries with placeholdersShell command buildingCommand injectionUse subprocess with argument lists, no shellPath concatenationPath traversalValidate and canonicalize pathsMD5/SHA1 for passwordsWeak hashingUse Argon2id or bcryptMath.random for tokensPredictable valuesUse crypto.getRandomValues
Inline Code Examples
SQL Injection โ insecure vs. secure (Python): # โ Insecure: string formatting allows SQL injection query = f"SELECT * FROM users WHERE username = '{username}'" cursor.execute(query) # โ Secure: parameterized query โ user input never interpreted as SQL query = "SELECT * FROM users WHERE username = %s" cursor.execute(query, (username,)) Password Hashing with Argon2id (Python): from argon2 import PasswordHasher ph = PasswordHasher() # uses secure defaults (time_cost, memory_cost) # On registration hashed = ph.hash(plain_password) # On login โ raises argon2.exceptions.VerifyMismatchError on failure ph.verify(hashed, plain_password) Secret Scanning โ core pattern matching (Python): import re, pathlib SECRET_PATTERNS = { "aws_access_key": re.compile(r"AKIA[0-9A-Z]{16}"), "github_token": re.compile(r"ghp_[A-Za-z0-9]{36}"), "private_key": re.compile(r"-----BEGIN (RSA |EC )?PRIVATE KEY-----"), "generic_secret": re.compile(r'(?i)(password|secret|api_key)\s*=\s*["\']?\S{8,}'), } def scan_file(path: pathlib.Path) -> list[dict]: findings = [] for lineno, line in enumerate(path.read_text(errors="replace").splitlines(), 1): for name, pattern in SECRET_PATTERNS.items(): if pattern.search(line): findings.append({"file": str(path), "line": lineno, "type": name}) return findings
Incident Response Workflow
Respond to and contain security incidents.
Workflow: Handle Security Incident
Identify and triage: Validate incident is genuine Assess initial scope and severity Activate incident response team Contain the threat: Isolate affected systems Block malicious IPs/accounts Disable compromised credentials Eradicate root cause: Remove malware/backdoors Patch vulnerabilities Update configurations Recover operations: Restore from clean backups Verify system integrity Monitor for recurrence Conduct post-mortem: Timeline reconstruction Root cause analysis Lessons learned Implement improvements: Update detection rules Enhance controls Update runbooks Document and report Validation: Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented
Incident Severity Levels
LevelResponse TimeEscalationP1 - Critical (active breach/exfiltration)ImmediateCISO, Legal, ExecutiveP2 - High (confirmed, contained)1 hourSecurity Lead, IT DirectorP3 - Medium (potential, under investigation)4 hoursSecurity TeamP4 - Low (suspicious, low impact)24 hoursOn-call engineer
Incident Response Checklist
PhaseActionsIdentificationValidate alert, assess scope, determine severityContainmentIsolate systems, preserve evidence, block accessEradicationRemove threat, patch vulnerabilities, reset credentialsRecoveryRestore services, verify integrity, increase monitoringLessons LearnedDocument timeline, identify gaps, update procedures
Recommended Security Tools
CategoryToolsSASTSemgrep, CodeQL, Bandit (Python), ESLint security pluginsDASTOWASP ZAP, Burp Suite, NiktoDependency ScanningSnyk, Dependabot, npm audit, pip-auditSecret DetectionGitLeaks, TruffleHog, detect-secretsContainer SecurityTrivy, Clair, AnchoreInfrastructureCheckov, tfsec, ScoutSuiteNetworkWireshark, Nmap, MasscanPenetrationMetasploit, sqlmap, Burp Suite Pro
Cryptographic Algorithm Selection
Use CaseAlgorithmKey SizeSymmetric encryptionAES-256-GCM256 bitsPassword hashingArgon2idN/A (use defaults)Message authenticationHMAC-SHA256256 bitsDigital signaturesEd25519256 bitsKey exchangeX25519256 bitsTLSTLS 1.3N/A See: references/cryptography-implementation.md
Scripts
ScriptPurposethreat_modeler.pySTRIDE threat analysis with DREAD risk scoring; JSON and text output; interactive guided modesecret_scanner.pyDetect hardcoded secrets and credentials across 20+ patterns; CI/CD integration ready For usage, see the inline code examples in Secure Code Review Workflow and the script source files directly.
References
DocumentContentsecurity-architecture-patterns.mdZero Trust, defense-in-depth, authentication patterns, API securitythreat-modeling-guide.mdSTRIDE methodology, attack trees, DREAD scoring, DFD creationcryptography-implementation.mdAES-GCM, RSA, Ed25519, password hashing, key management
Security Headers Checklist
HeaderRecommended ValueContent-Security-Policydefault-src self; script-src selfX-Frame-OptionsDENYX-Content-Type-OptionsnosniffStrict-Transport-Securitymax-age=31536000; includeSubDomainsReferrer-Policystrict-origin-when-cross-originPermissions-Policygeolocation=(), microphone=(), camera=() For compliance framework requirements (OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, SOC 2), refer to the respective official documentation.
Related Skills
SkillIntegration Pointsenior-devopsCI/CD security, infrastructure hardeningsenior-secopsSecurity monitoring, incident responsesenior-backendSecure API developmentsenior-architectSecurity architecture decisions
Category context
Code helpers, APIs, CLIs, browser automation, testing, and developer operations.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
4 Docs2 Scripts
- SKILL.md
- references/cryptography-implementation.md
- references/security-architecture-patterns.md
- references/threat-modeling-guide.md
- scripts/secret_scanner.py
- scripts/threat_modeler.py