# Strengthen Security Engineering Decisions

Security work often spans architecture, identity, compliance, testing, and response planning. This skill gives Claude, Codex, and Claude Code structured security engineering guidance.

## Install

```bash
npx skillstore add joseph obrien/89jobrien-security-engineering
```

## Metadata

- Status: approved
- Slug: 89jobrien-security-engineering
- Version: 1.0.1
- Author version: 1.0.1
- Skillstore revision: r1
- Version status: valid
- Tree hash: 250e01d0a5d2ac6584d63ab59b4066449944f78f58f16baafee2c5ce2a4a2a29
- Author: Joseph OBrien
- GitHub username: 89jobrien
- License: MIT
- Repository: https://github.com/89jobrien/steve/tree/main/steve/skills/security-engineering
- Ref: c4037264bbd363c572662d6154a3ab28f5ca4f53
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 81
- Quality tier: silver
- Public page: https://skillstore.pages.dev/skills/89jobrien-security-engineering
- Manifest: https://skillstore.pages.dev/api/skills/89jobrien-security-engineering/manifest

## Capabilities

- Explains defense in depth and zero trust architecture patterns.
- Guides OAuth 2.0, OIDC, session management, and MFA choices.
- Compares RBAC, ABAC, and policy as code approaches.
- Summarizes OWASP Top 10 mitigation strategies and security testing methods.
- Outlines secrets management, compliance controls, and incident response phases.

## Use Cases

- Design Authentication Controls: Select OAuth, OIDC, session, and MFA patterns for a product architecture review.
- Prepare A Threat Model: Structure security questions around access control, data protection, and common application risks.
- Map Compliance Work: Identify common control areas for SOC 2, HIPAA, PCI-DSS, GDPR, or ISO 27001 planning.

## Prompt Templates

### Review My Security Design

```
Use the security-engineering skill to review this design. Focus on identity, data protection, logging, and missing controls.
```

### Choose An Authorization Model

```
Use the security-engineering skill to compare RBAC, ABAC, and policy as code for this product. Recommend a practical model.
```

### Create A Secure Development Checklist

```
Use the security-engineering skill to create a release checklist for OWASP risks, testing, dependencies, and secrets management.
```

### Plan Incident Response Controls

```
Use the security-engineering skill to assess this incident response plan. Identify gaps in detection, containment, recovery, and lessons learned.
```

## Limitations

- Does not include runnable scanners, scripts, or automated enforcement.
- Does not replace expert review for regulated systems or live incidents.
- References supplemental files that are not included in this package.
- Provides general patterns, not organization-specific control mappings.

## Best Practices

- Provide system context, data sensitivity, and deployment model before requesting security guidance.
- Ask for tradeoffs when choosing between identity, authorization, and monitoring controls.
- Validate final recommendations with your security team and regulatory obligations.

## Anti Patterns

- Do not treat general control guidance as a complete compliance audit.
- Do not paste live secrets, private keys, or production credentials into prompts.
- Do not use the skill to justify unsafe exceptions without compensating controls.

## Security Audit

- Audited at: 2026-07-05T13:36:33.446\+00:00
- Summary: All seven static findings are false positives caused by Markdown formatting or defensive security guidance. No evidence found of prompt injection, data exfiltration intent, or executable command behavior in SKILL.md.

## Stats

- Views: 174
- Downloads: 18
- Favorites: 0
- Popularity score: 0