> Reusable workflow extracted from luca-security-expert expertise.
Conducts comprehensive security audits using OWASP Top 10 and threat modeling to identify vulnerabilities. Triggers for pre-release validation, compliance audits, or post-incident reviews, producing prioritized remediation roadmaps.
/plugin marketplace add Roberdan/MyConvergio/plugin install roberdan-myconvergio@Roberdan/MyConvergioThis skill inherits all available tools. When active, it can use any tool Claude has access to.
Reusable workflow extracted from luca-security-expert expertise.
Conduct comprehensive security assessments to identify vulnerabilities, assess risks, and provide remediation strategies aligned with OWASP, zero-trust principles, and compliance requirements.
Scope Definition
Information Gathering
Threat Modeling
Vulnerability Assessment
Risk Analysis
Penetration Testing (if authorized)
Remediation Planning
Reporting & Validation
| Severity | Likelihood | Impact | Action Required |
|---|---|---|---|
| Critical | High + High | Data breach, system compromise | Fix within 24 hours |
| High | High + Medium or Medium + High | Significant security risk | Fix within 7 days |
| Medium | Medium + Medium or Low + High | Moderate security concern | Fix within 30 days |
| Low | Low + Low or Low + Medium | Minor security issue | Fix in next release |
Input: Pre-release security audit for financial application
Workflow Execution:
1. Scope: Web app + API + Database, PCI-DSS compliance required
2. Information: React frontend, Node.js API, PostgreSQL, AWS hosting
3. Threat Model: STRIDE analysis identifies data exposure and injection risks
4. Vulnerabilities Found:
- 🔴 CRITICAL: SQL injection in payment endpoint
- 🔴 CRITICAL: JWT tokens never expire
- 🟠 HIGH: Weak password policy (6 chars, no complexity)
- 🟡 MEDIUM: Missing rate limiting on API
- 🟢 LOW: Security headers not optimized
5. Risk Analysis: SQL injection = HIGH likelihood + CRITICAL impact = P0
6. Remediation:
- P0: Parameterized queries, token expiration (24h immediate)
- P1: Password policy update, rate limiting (7 days)
- P2: Security headers (next sprint)
7. Report: Executive summary + technical details + remediation roadmap
8. Validation: Re-test after fixes applied
Output:
BLOCKED for release - 2 critical vulnerabilities must be fixed first
Remediation roadmap provided with 24h timeline for critical fixes
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.