skills.rest
learnn-com
learnn-comOFFICIAL
Explore all skills by this author →
WebsiteGitHub

capability-assess-security

Assess project security posture against OWASP Top 10 and write adoption files.

Updated Mar 31, 2026
Search Tags:#owasp#compliance#monorepo#decision log#security assessment#adoption files#vulnerability tracking
One-click install
npx skills add https://github.com/learnn-com/engineering-kb --skill capability-assess-security-learnn-com
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: capability-assess-security
Source: https://github.com/learnn-com/engineering-kb/tree/main/.skills/capability-assess-security
Command: npx skills add https://github.com/learnn-com/engineering-kb --skill capability-assess-security-learnn-com

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams often lack a documented, consistent security posture across packages, with rules scattered or duplicated between global and package-level files. This Skill evaluates the project against OWASP Top 10 categories, identifies gaps and open vulnerabilities, and records the security strategy as a decision log entry. ## Core Features & Use Cases - Resolution Cascade: Skips redundant work by checking for an explicit override argument, then existing adoption, before running a full assessment — making the workflow idempotent. - OWASP Top 10 Assessment: Evaluates each package (web, mobile, services) against all ten OWASP categories and assigns P0–P3 severity to gaps. - Adoption & Decision Recording: Writes global security principles to adoption/tech/security.md, creates missing package-level .pair.security.md files, and composes /capability-record-decision to log the strategy. - Use Case: Before a release, run a full-project security assessment to confirm OWASP coverage, track open vulnerabilities by severity, and backfill any missing decision records. ## Quick Start Ask the AI to assess the security posture of the project and document the adopted security controls.

Frequently Asked Questions about capability-assess-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I assess my project's security posture against OWASP Top 10?▼

Run the assessment without arguments to evaluate all packages against the ten OWASP categories. The skill reads security guidelines and package files, assigns P0–P3 severity to gaps, and presents a findings summary for approval before writing adoption files.

How do I adopt a specific security control set without a full assessment?▼

Pass the choice argument, such as owasp-top10, to skip the assessment and adopt that control set directly. The skill asks for confirmation, warns if a different adoption already exists, then writes the adoption and records the decision.

Can I limit the security assessment to a single package?▼

Yes, pass the scope argument with web, mobile, or services to assess only that package. Omitting the scope runs a full project assessment across all packages present.

What happens if a package has no .pair.security.md file?▼

The skill flags it as a gap and creates the file with open vulnerabilities, security rules, exceptions, and references. It also adds the new file to the Security Review Process section of the global adoption file.

Does the skill duplicate rules between global and package security files?▼

No. Global adoption/tech/security.md owns cross-cutting principles while package .pair.security.md files own implementation-specific rules and open vulnerabilities. Rules already documented in package files are treated as addressed and never duplicated.

What happens if the security guidelines or decision-recording skill are missing?▼

The skill degrades gracefully: it falls back to OWASP Top 10 as the minimal framework when guidelines are absent, and warns while skipping decision recording if /capability-record-decision is not installed.

Related Skills

Explore More Software Engineering Skills→
bvshibvshi

10x-tech-stack-selector

Select a tech stack for a greenfield project from a PRD and quality gates.

Community
Advanced
tektonlabstektonlabs

remediation-log

Generate security remediation tracking documentation for vulnerability fixes and SLA compliance.

Official
Intermediate
NUMU-IONUMU-IO
2

speckit-security-review-audit

Audit repository changes for security vulnerabilities and generate remediation tasks.

Official
Advanced
foomakersfoomakers
6

pair-capability-assess-testing

Assess project testing strategy and update tech-stack.md with ADL or ADR.

Official
Advanced