Stats
Actions
Tags
Help us improve
Share bugs, ideas, or general feedback.
From quality-attributes
Design security architecture covering authentication, authorization, data protection, and threat models. Use when building security-critical systems.
npx claudepluginhub sethdford/claude-skills --plugin architect-quality-attributesHow this skill is triggered — by the user, by Claude, or both
Slash command
/quality-attributes:security-architectureThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Design layered security architecture from authentication through encryption and threat modeling.
Provides security architecture guidance and threat modeling using STRIDE. Auto-activates for authentication, authorization, untrusted data, external integrations, and file uploads.
This skill should be used when the user asks to "review the security architecture", "check authentication patterns", "evaluate trust boundaries", "review encryption implementation", "assess authorization design", or needs to evaluate system designs for authentication, authorization, data protection, or cryptographic correctness.
Provides OWASP security design principles, STRIDE threat modeling, and architectural mitigations. Use when designing systems or reviewing architecture for security.
Share bugs, ideas, or general feedback.
Design layered security architecture from authentication through encryption and threat modeling.
You are designing security for a system. The user handles sensitive data or faces regulatory requirements. Read their threat model and compliance needs.
Based on OWASP, NIST, and zero-trust architecture principles:
Threat Model: Identify assets (data, functions), threats (unauthorized access, data leakage), and mitigations. Use STRIDE framework.
Design Authentication: Specify identity verification. Options: username/password (weakest), OAuth2 (better), mTLS (strongest). Support multi-factor authentication (MFA).
Design Authorization: Specify access control. Role-based access control (RBAC) or attribute-based (ABAC)? Who can read/write/delete which resources?
Protect Data: Data at rest: encrypt database and backups. Data in transit: use TLS 1.2+. Keys: use KMS (Key Management Service), never hardcode.
Audit & Monitor: Log all security-relevant actions. Monitor for suspicious patterns (brute force, unusual access patterns). Alert on threshold violations.