magnus919_agent-skills/secure-software-engineering

Secure Software Engineering

Build security into software decisions before they become expensive defects.

Why Install This Skill

This skill helps an agent turn "make it secure" into concrete design choices: what must be protected, who may do what, where trust changes, and how a team can verify the result. It covers everyday engineering work such as APIs, credentials, dependencies, multi-tenant services, release artifacts, and AI features without assuming a cloud provider or framework.

Instead of treating a checklist or scanner as a security guarantee, the workflow asks for evidence, assumptions, misuse cases, and accountable residual-risk decisions. It complements an assessment skill: use this one while building and changing software, then assess or scan separately when that is the actual task.

What You Get

Path	What it provides
SKILL.md	A five-phase, prevention-oriented workflow and routing guide.
references/source-index.md	Version-pinned primary sources and the decisions they inform.
references/	Focused guidance for threat modeling, controls, review, release, incident learning, AI systems, and multi-tenant boundaries.
templates/	Adaptable threat-model, acceptance-criteria, and review-checklist starting points.

Quick Start

Install or expose this directory through your Agent Skills-compatible client. Then ask, for example:

Threat-model this multi-tenant document API before implementation.

The resulting model should name assets, boundaries, assumptions, abuse cases, mitigations, evidence, and residual risk rather than simply declare the API secure.

Triggers

• Design or implement a feature securely.
• Threat-model a system, API, integration, tenant boundary, or AI capability.
• Define security acceptance criteria or review a security-sensitive change.
• Choose authentication, authorization, secret handling, dependency, logging, or release-evidence practices.
• Threat-model pooled, bridge, or silo tenant isolation, support impersonation, tenant lifecycle, or shared-resource exhaustion.

Requirements

No runtime dependency, API key, or platform-specific tool is required. The included sources are decision aids; adopt the controls that apply to your organization, contract, regulator, and threat model.

For end-to-end SaaS tenant semantics and placement decisions, use multi-tenant-saas-architecture. For quantitative tenant capacity and cost evidence, use capacity-and-cost-engineering; for privacy lifecycle artifacts, use privacy-engineering.