What problem does it solve? Security issues are cheapest to fix before shipping, but teams often skip structured threat modeling when reviewing PRs that touch auth, payments, smart contracts, secrets, or infrastructure. This Skill enforces a Definition-of-Done security gate so every security-relevant change gets a threat model, layer-specific checklist review, and required scans before merge. ## Core Features & Use Cases - Structured Threat Modeling: Fill a standard template covering protected assets, entrypoints, actors, trust boundaries, top threats, assumptions, and residual risks. - Layer-Specific Checklists: Review guidance for Web2/API security (auth, authorization, input validation, rate limiting), Web3/smart contracts (reentrancy, oracles, MEV, upgradeability), frontend (wallet signing, CSP, phishing), and infrastructure (CI secrets, dependencies, containers). - Required Scans Gate: A merge-blocking table of tools including gitleaks, osv-scanner, semgrep, slither, aderyn, and forge tests, plus incident and escalation procedures. - Use Case: When reviewing a PR that adds a withdrawal endpoint, apply this Skill to produce a threat model, verify object-level authorization and idempotency keys, and confirm secrets and SAST scans are green before approving. ## Quick Start Apply the security threat checklist to this PR and return the threat model, blockers, and required scans that must pass before merge.
