skills.rest
monang404
monang404COMMUNITY
Explore all skills by this author →
GitHub

security-scanning-security-hardening

Coordinate multi-phase security scanning, remediation, and compliance validation across application layers.

2|Updated Jun 16, 2026
Search Tags:#vulnerability assessment#threat modeling#penetration testing#compliance#security scanning#devsecops#hardening
One-click install
npx skills add https://github.com/monang404/lunawave --skill security-scanning-security-hardening-monang404
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scanning-security-hardening
Source: https://github.com/monang404/lunawave/tree/main/.agent/skills/security-scanning-security-hardening
Command: npx skills add https://github.com/monang404/lunawave --skill security-scanning-security-hardening-monang404

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security work often happens in isolated scans that never turn into actual fixes. This Skill orchestrates a full defense-in-depth program: it runs vulnerability assessments, threat modeling, remediation, infrastructure hardening, and compliance validation as one coordinated multi-phase workflow. ## Core Features & Use Cases - Comprehensive Assessment: Runs SAST, DAST, dependency audits, secrets detection, and SBOM generation, then maps findings to STRIDE threat models and MITRE ATT&CK. - Layered Remediation: Fixes critical vulnerabilities (CVSS 7+), hardens backend APIs, frontend CSP/XSS defenses, mobile apps, and deploys WAF, network segmentation, and secrets management. - Validation & Compliance: Performs penetration testing, verifies OWASP ASVS/CIS/SOC2/GDPR compliance, and sets up SIEM monitoring with incident response playbooks. - Use Case: Before launching a new web platform, run this Skill to baseline vulnerabilities, remediate critical findings, enforce MFA and encryption, and produce a compliance attestation report for auditors. ## Quick Start Run a comprehensive security hardening program against my web application codebase and infrastructure configuration.

Frequently Asked Questions about security-scanning-security-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a comprehensive security assessment on my application?▼

Start with Phase 1, which runs SAST with Semgrep or SonarQube, DAST with OWASP ZAP, dependency audits with Snyk or Trivy, and secrets detection with GitLeaks. Results feed into STRIDE threat modeling and an architecture security review.

What tools does this security hardening workflow use?▼

The workflow references Semgrep, SonarQube, OWASP ZAP, Snyk, Trivy, GitLeaks, TruffleHog, Burp Suite, Metasploit, HashiCorp Vault, and SIEM platforms like Splunk, ELK, or Sentinel for monitoring.

Which compliance frameworks does the validation phase cover?▼

Phase 4 validates against OWASP ASVS Level 2, CIS Benchmarks, SOC2 Type II, GDPR, CCPA, and optionally HIPAA or PCI-DSS. It produces compliance attestation reports, gap analyses, and audit evidence.

Can I run penetration testing in a production environment?▼

The Skill explicitly warns against intrusive testing in production without approval. Ensure you have authorization and rollback plans before hardening changes, and prefer staging environments for exploit validation.

When should I not use this security hardening workflow?▼

Skip it when you only need a quick scan without remediation, lack authorization for security testing, or operate in an environment that cannot tolerate invasive security controls. It is designed for full hardening programs, not one-off checks.

Related Skills

Explore More Software Engineering Skills→
Blake-JohnBlake-John

security-reviewer

Identify security vulnerabilities and generate structured audit reports with severity ratings.

Community
Advanced
nksethnkseth

security-reviewer

Identify security vulnerabilities in code and infrastructure and deliver prioritized audit reports with remediation guidance.

Community
Advanced
starwreckntxstarwreckntx

Security Orchestration Agent

Automate security playbooks and incident-response workflows across security swarm agents.

Community
Basic
jankneumannjankneumann
4

security-review

Detect repository signals, run OWASP Dependency-Check and ZAP scanners, and produce a unified security report with a gate decision.

Community
Advanced