oc-security-auditor
Practice-level security posture assessment: threat modeling (STRIDE), OWASP Top 10 compliance mapping, runtime/infra hardening (CSP, TLS, DNS, WAF, Cloudflare config), and attack surface mapping. Operates ABOVE oc-code-auditor — oc-code-auditor finds SQLi and hardcoded secrets; oc-security-auditor asks "what's the threat model?" and "is the infra hardened?" ALWAYS trigger on /oc-security, /oc-secaudit, /oc-sec, /oc-threat-model, /oc-owasp, /oc-hardening, /oc-attack-surface, /oc-posture. Also trigger on: "threat model this app", "is this secure enough", "OWASP compliance", "security review", "attack surface", "is it hardened", "what are the security risks", "SOC2 readiness", "pen test prep", "security architecture review", "audit the CSP policy", "review WAF rules", "check TLS config". Trigger on architecture-, infrastructure-, or compliance-level security questions — not just code bugs. Assessment only: oc-security-hardening (/oc-harden) executes the fixes; oc-compliance-ops keeps the
Target: Cloud, operations & security. Automatically collected · unverified.
Excerpt from the author’s documentation
Extracted from a fixed version of SKILL.md in its original language. This is the author’s documentation; installation, compatibility and runtime results have not been verified by this site.
Read the original English text
Topics in the source
- Security Auditor
- /oc-security — Command Reference
- Relationship to oc-code-auditor
- Pillar 1: Threat Modeling
- STRIDE Analysis (/oc-security threat-model)
- Process
- Attack Surface Mapping (/oc-security attack-surface)
- Adversary Profiling (/oc-security adversaries)
On first invocation, read references/orchestrator.md and follow its welcome protocol. Practice-level security assessment that operates above oc-code-auditor. Where oc-code-auditor greps for SQL injection and hardcoded secrets, oc-security-auditor asks: What's the threat model? Who are the adversaries? What's exposed? Is the infrastructure hardened? Are we compliant? Three pillars: Threat Modeling, Compliance Mapping, Runtime Hardening. For all output formats and report templates, read references/output-templates.md. -- | Layer | Owner | Examples | |---|---|---| | Code-level | oc-code-auditor | SQLi, XSS, hardcoded secrets, auth middleware, dep vulns | | Architecture-level | oc-security-auditor | Threat models, trust boundaries, data flow, attack surface | | Compliance-level | oc-security-auditor | OWASP Top 10 mapping, SOC2 gap analysis, policy checklists | | Infra/runtime-level | oc-security-auditor | CSP headers, TLS config, DNS security, WAF rules | Chaining rules: After /oc-audit security (oc-code-auditor) → oc-security-auditor takes the architecture + infra layers During /oc-security posture step 2 → check if oc-code-auditor checkpoint exists. If not, Invoke the Skill tool wit
This is an excerpt. Refer to the complete source and its current requirements.
- Source repository
- asfbay-bit/opchain-skills
- Source file
- plugins/opchain/skills/oc-security-auditor/SKILL.md
- Fixed revision
- 1c7c7bd69a7d875a5dffb419911c24752ca6c285
Sources and evidence
This record was collected automatically. Its documentation, suitability and runtime behavior have not been manually verified.
Author: asfbay-bit/opchain-skills · original repository metadata. Documentation review: Not reviewed. Last source check: 2026-11-10T17:01:27.023Z.
Categories are inferred from names, descriptions and paths. They do not establish compatibility.
License and attribution
Apache-2.0. Third-party content and copyright remain with their authors. Refer to the original license and terms.
Original license ↗Synchronization, copying and user-reported success do not mark a resource as runtime-tested.
Limitations and notes
- Collecting metadata does not mean this site has installed, adapted, runtime-tested or security-reviewed the resource.