Agent Skills › bacoco/BMad-Skills › bmad-security-review

bmad-security-review

GitHub

用于对系统架构、设计或实现进行结构化安全审查，包括威胁建模、风险评估和合规检查。旨在早期暴露安全风险，生成修复待办事项，为产品发布提供安全建议。

.claude/skills/bmad-security-review/SKILL.md bacoco/BMad-Skills

Trigger Scenarios

请求功能或系统的安全、隐私或合规审查提及威胁建模、安全设计、风险评估或渗透测试需要加固基础设施、API、数据流或部署管道需要在发布前获取修复待办事项收到需分类处理的外部审计发现

Install

npx skills add bacoco/BMad-Skills --skill bmad-security-review -g -y

More Options

Non-standard path

npx skills add https://github.com/bacoco/BMad-Skills/tree/main/.claude/skills/bmad-security-review -g -y

Use without installing

npx skills use bacoco/BMad-Skills@bmad-security-review

指定 Agent (Claude Code)

npx skills add bacoco/BMad-Skills --skill bmad-security-review -a claude-code -g -y

安装 repo 全部 skill

npx skills add bacoco/BMad-Skills --all -g -y

预览 repo 内 skill

npx skills add bacoco/BMad-Skills --list

SKILL.md

Frontmatter

{
    "name": "bmad-security-review",
    "metadata": {
        "outputs": [
            "threat-model",
            "security-gap-assessment",
            "remediation-backlog"
        ],
        "triggers": {
            "keywords": [
                "security",
                "threat-model",
                "vulnerability",
                "secure",
                "harden",
                "compliance",
                "privacy"
            ],
            "patterns": [
                "threat model",
                "security review",
                "penetration test",
                "secure this",
                "hardening plan",
                "security requirements",
                "compliance gap"
            ]
        },
        "auto-invoke": true,
        "capabilities": [
            "threat-modeling",
            "secure-design",
            "dependency-audit",
            "remediation-planning",
            "compliance-checks"
        ],
        "prerequisites": [
            "bmad-architecture-design",
            "bmad-test-strategy"
        ]
    },
    "description": "Hardens designs and implementations with structured security reviews.",
    "allowed-tools": [
        "Read",
        "Write",
        "Grep"
    ]
}

BMAD Security Review Skill

When to Invoke

Activate this skill whenever the user:

Requests a security, privacy, or compliance review of a feature or system.
Mentions threat modeling, secure design, risk assessment, or penetration testing.
Asks for guidance on hardening infrastructure, APIs, data flows, or deployment pipelines.
Needs a remediation backlog prior to launch or certification.
Receives external audit findings that must be triaged and addressed.

Do not invoke when the user only needs implementation help with security stories—route those to bmad-development-execution once the remediation plan exists.

Mission

Protect the product by exposing security risks early, prioritizing fixes, and embedding mitigations into the delivery plan. Deliver artifacts that downstream skills and teams can execute without ambiguity.

Inputs Required

Architecture decisions, diagrams, or code references (docs/architecture.md, repositories, infrastructure manifests).
Current product requirements, especially data handling and auth flows.
Any existing penetration test reports, compliance requirements, or known incidents.
Deployment environment details (cloud provider, runtimes, integrations).

If critical context is missing, schedule discovery steps in WORKFLOW.md before producing findings.

Outputs

Threat model covering data flows, trust boundaries, STRIDE analysis, and mitigations using templates in assets/.
Security gap assessment summarizing findings by severity with clear owners and due dates.
Remediation backlog with prioritized user stories and acceptance criteria ready for bmad-story-planning.
Optional compliance checklists (SOC2, HIPAA, GDPR) when requested.

Process

Confirm prerequisites are satisfied (architecture + test strategy). Request missing artifacts.
Map system boundaries and data classifications. Document entry points and critical assets.
Run threat modeling workshops: enumerate threats via STRIDE/LINDDUN and rate likelihood × impact.
Review code, dependencies, and infrastructure for known vulnerabilities or misconfigurations.
Summarize findings with severity, evidence, and references to assets or standards violated.
Translate mitigations into actionable backlog items. Align with release timelines.
Provide launch go/no-go recommendation and residual risk statement.

Quality Gates

No critical/high risks without documented mitigation and owner.
Threat model reviewed against latest architecture diagram.
Remediation backlog linked to acceptance criteria consumable by dev/test skills.
Compliance requirements traced to controls or follow-up activities.

Error Handling

If findings rely on missing context, pause and obtain evidence before finalizing reports.
Escalate systemic issues (e.g., absence of IAM, encryption gaps) to product leadership via orchestrator.
Document assumptions; flag when runtime verification (DAST/SAST) is required beyond conversational review.