Claude Code: Security & Auditing Skills

Use when the user asks to "map data flows", "trace data through the system", "show how data moves", "identify trust boundaries", "find where data is encrypted or decrypted", "map PII flows", or "trace input to storage". Also triggers when the user asks about data transformation pipelines, where sensitive data is processed, or how user input reaches databases or external services.

Use when the user asks to "check for detectability", "analyze timing side channels", "find privacy issues related to traffic analysis", "check for metadata leakage", or mentions "detectability" in a privacy context. Maps to LINDDUN category D1.

Use when the user asks to "check for integrity issues", "analyze deserialization", "find supply chain vulnerabilities", "review CI/CD security", "check SRI", or mentions "deserialization", "integrity", "pipeline security", "code signing", or "supply chain" in a security context. Maps to OWASP Top 10 2021 A08: Software and Data Integrity Failures.

Use when the user asks to "run LINDDUN analysis", "check privacy threats", "privacy threat model", "GDPR analysis", "check data protection", or invokes /appsec:linddun. Dispatches 7 category subagents in parallel for comprehensive LINDDUN privacy threat coverage.

Use when the user asks to "check for linkability", "analyze cross-service tracking", "find privacy issues related to user correlation", "check for cross-domain tracking", or mentions "linkability" in a privacy context. Maps to LINDDUN category L.

Use when you have a specified engineering task or task list and need to decide which AI model should handle each work unit — routes tasks across Claude Opus/Sonnet/Haiku, GPT-5.4 family, GPT-5.3-Codex, and Gemini 2.5/3 with per-unit category, evidence-based rationale, context briefing, and failure-mode warnings. Also checks whether the task is broken down enough and proposes finer decomposition before routing.

Use when the user asks to "check for misconfigurations", "analyze security headers", "find misconfigured settings", "check CORS policy", "find debug mode", "audit server configuration", or mentions "misconfiguration" in a security context. Maps to OWASP Top 10 2021 A05: Security Misconfiguration.

Use when the user asks to "map to ATT&CK", "show attack techniques", "MITRE mapping", or wants to understand how findings relate to real-world attacker behavior. Maps security findings to MITRE ATT&CK tactics, techniques, and procedures.

Use when the user asks to "simulate attacks", "build attack trees", "model exploit chains", "score exploitability", or is running PASTA stage 6. Also triggers when the user asks about attack scenarios, red team simulation, DREAD scoring, or detection gap analysis in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 6 of 7).

Use when the user asks to "calculate risk scores", "prioritize mitigations", "generate remediation roadmap", "analyze business impact", or is running PASTA stage 7. Also triggers when the user asks about risk-weighted findings, compliance gap analysis, or executive security summary in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 7 of 7).

Use when the user asks to "check CWE Top 25", "run SANS analysis", "check for common weaknesses", or mentions "CWE" or "SANS Top 25" in a security context. Checks code against the SANS/CWE Top 25 Most Dangerous Software Weaknesses.

Use when the user asks to "export all sessions", "export all session logs", "batch export sessions", "sessionlog export-all", "convert all sessions", or wants to export every Claude Code session for the current project as standard LLM conversation JSON and TXT files.

Use when the user asks to "write specifications", "create test specifications", "specification-driven development", "spec-first", "behavioral specs", "derive test scenarios", "test implementation specification", "check specification alignment", "review specs", "verify implementation", or "spec-dd". Also triggers when the user mentions "SDD", "SDD-TDD", "spec-driven", "behavioral testing workflow", "test-first design", or asks about writing specifications before code, deriving tests from specs, or verifying implementation against specifications. Supports a full workflow walkthrough or focusing on individual phases.

Use when the user asks to "check for spoofing", "analyze identity spoofing risks", "find authentication vulnerabilities", or mentions "spoofing" in a security context. Maps to STRIDE category S.

Arm the current Claude Code session to self-terminate by uttering a kill phrase once all work is finished and no questions remain. Use when the user says "terminate when done", "whendone", "end the session when finished", or "self-terminate when complete".

Analyze Claude Code session token usage to flag waste and optimization opportunities. Use when the user asks to "analyze token usage", "check token efficiency", "audit token spend", "tokeneconomics", "reduce token costs", "optimize token usage", "check my burn rate", or mentions token waste, session costs, usage limits, cache efficiency, or conversation sprawl.