secure-sdlc
Security reference library for this stack. Covers threat modeling (STRIDE), security requirements (EARS), pre-merge security review checklist, and incident response playbooks. Load when designing integrations, reviewing security-sensitive PRs, or responding to incidents.
Resources
1Install
npx skillscat add kirvin/agent-dev-harness/secure-sdlc Install via the SkillsCat registry.
Secure SDLC
A reference library for security work in this stack. Load the relevant reference for
the current task rather than reading everything upfront.
When to load each reference
| Task | Reference |
|---|---|
| Threat modeling a new feature or integration | references/threat-model.md |
| Writing EARS security invariants | references/security-requirements.md |
| Pre-merge security review of a PR | references/pre-merge-checklist.md |
| Responding to a credential leak or incident | references/incident-response.md |
Quick orientation
Threat model → identify what could go wrong (STRIDE) → feeds into EARS + ADR layers
Security requirements → EARS invariants that encode non-negotiable security constraints;
one file per domain (auth.md, data.md, pipeline.md)
Pre-merge checklist → runnable commands + human-review items; must pass before merging
security-sensitive changes
Incident response → step-by-step playbooks for AWS credential compromise, Figma token
leak, git history exposure; each playbook is self-contained
Stack context
This skill is calibrated for the agent-dev-harness stack:
- AWS Bedrock as the Claude Code provider (SSO-based auth via AWS profiles)
- GitHub Actions CI with SHA-pinned actions
- Figma API integration (personal access tokens)
- Beads issue tracker for finding remediation
- Node.js / TypeScript projects
Relationship to other security skills
kf:security-sweep— retrospective analysis after code is written; this skill is for during design and reviewce:managing-pipelines— CI/CD hardening; complements this skill for pipeline-specific changes
Load the reference that matches your current task. Do not load all four unless the situation requires it.
Categories
Install
npx skillscat add kirvin/agent-dev-harness/secure-sdlc Install via the SkillsCat registry.