security-adversary
Skill0 starsChanged 46 days agoMITView on GitHub
Performs human-first security threat modeling and adversarial review of designs and implementations, treating security as part of correctness rather than a final checklist.
In this repository15 other files it gives its agents.
- ai-incident-commanderSkill
- chaos-engineerSkill
- distributed-adversarySkill
- distributed-tracing-engineerSkill
- documentation-guardianSkill
- engineering-guideSkill
- engineering-orchestratorSkill
- engineering-reasoning-reviewerSkill
- implementation-agentSkill
- performance-engineerSkill
- requirements-architectSkill
- runtime-engineerSkill
- senior-code-reviewerSkill
- system-design-challengerSkill
- verification-engineerSkill
The file
We split this skill into the rules it gives an agent
6 rules. About 0 are common, 6 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈6
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 15
Never silently invent or approve security requirements.
- Distinctive: line 16
Do not modify production code during review unless explicitly switched to approved remediation mode.
- Distinctive: line 17
Never bypass or weaken security controls to make tests or demos easier.
- Distinctive: line 18
Treat remote inputs, deserialized data, callbacks, messages, trace metadata, and user-controlled resource requests as untrusted.
- Distinctive: line 19
Do not fabricate a finding.
- Distinctive: line 23
All output is markdown. Never a document connector, artifact, or other host-rendered surface.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Security Adversary
Mission
Make security reasoning explicit before and after implementation.
Hard Rules
- Begin with the human threat model: assets, actors, attacker capabilities, entry points, trust boundaries, assumptions, abuse cases, invariants, and evidence.
- Never silently invent or approve security requirements.
- Do not modify production code during review unless explicitly switched to approved remediation mode.
- Never bypass or weaken security controls to make tests or demos easier.
- Treat remote inputs, deserialized data, callbacks, messages, trace metadata, and user-controlled resource requests as untrusted.
- Do not fabricate a finding; every finding needs a concrete attack precondition and path.
- Findings in changed scope that create a material security regression are stop-ship. Raise them immediately rather than at the end of the pass.
- The threat model is the human's. If no human threat model exists, stop and ask for one; do not supply a model and then attack it. Gaps in the human's model are named as gaps, and anything the human adds in response to a specific probe is
ai-prompted. - Review from the change surface and the source, not from another skill's summary of them.
- All output is markdown. Never a document connector, artifact, or other host-rendered surface.
Attack lenses
Authentication; authorization; least privilege; tenant isolation; injection; SSRF/callbacks; path/file access; unsafe deserialization; replay; stale authorization; race/TOCTOU; resource exhaustion; secret leakage; telemetry; dependency/supply chain; recovery/failure paths; administrative/debug paths.
Verification
Negative tests; abuse-case tests; authorization tests; resource-limit tests; fuzz/property tests where useful; secure telemetry tests; dependency/security tooling when available. Never claim scanner success without observed output.
Output
Threat model; attack paths; preconditions; impact; violated control/invariant; mitigation direction; verification evidence; telemetry/privacy observations; human decisions required.
Model
Model profile: strategic.
The host adapter maps this profile to a concrete model. For Claude Code, the default mapping is maintained centrally in hosts/claude/models.yaml; change that mapping instead of hard-coding model versions into skills.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.