security-analysis

采用 STRIDE 威胁建模、OWASP Top 10 以及 CVSS 评分，进行安全评估。适用于安全审查、威胁建模，以及安全编码指导时使用。

SKILL.md

--- frontmatter

name: security-analysis
description: Security assessment using STRIDE threat modeling, OWASP Top 10, and CVSS scoring. Use for security reviews, threat modeling, and secure coding guidance.
metadata: {"clawdbot":{"requires":{"env":[]}}}
user-invocable: true

Security Analysis

Comprehensive security assessment framework.

Frameworks Included

STRIDE Threat Modeling

Categorize threats by type:

Threat	Description	Example
Spoofing	Impersonating something/someone	Fake login page
Tampering	Modifying data/code	SQL injection
Repudiation	Denying actions	Missing audit logs
Information Disclosure	Exposing data	Error message leaks
Denial of Service	Disrupting availability	Resource exhaustion
Elevation of Privilege	Gaining unauthorized access	Broken access control

OWASP Top 10 (2021)

Check for common vulnerabilities:

•A01: Broken Access Control
•A02: Cryptographic Failures
•A03: Injection
•A04: Insecure Design
•A05: Security Misconfiguration
•A06: Vulnerable Components
•A07: Auth Failures
•A08: Integrity Failures
•A09: Logging Failures
•A10: SSRF

CVSS Scoring

Rate vulnerability severity:

Score	Severity	Action
9.0-10.0	Critical	Fix immediately
7.0-8.9	High	Fix within days
4.0-6.9	Medium	Fix within weeks
0.1-3.9	Low	Fix when convenient

Security Review Process

Phase 1: Attack Surface Mapping

Identify all entry points:

•API endpoints
•User inputs
•File uploads
•External integrations
•Authentication flows

Phase 2: STRIDE Analysis

For each entry point, check all STRIDE categories.

Phase 3: OWASP Checklist

Verify protection against Top 10.

Phase 4: Risk Scoring

Apply CVSS to findings.

Phase 5: Remediation Plan

Prioritize fixes by severity.

Output Template

markdown

## Security Analysis: [Component/Feature]

### Attack Surface
| Entry Point | Type | Trust Level |
|-------------|------|-------------|
| [endpoint] | API | Untrusted |
| [input] | User | Untrusted |

### STRIDE Assessment

#### Spoofing
- Risk: [description]
- Mitigation: [control]
- Status: [Mitigated/Open]

#### Tampering
...

### OWASP Top 10 Check
| Category | Status | Notes |
|----------|--------|-------|
| A01 Broken Access Control | ✓/✗ | |
| A02 Crypto Failures | ✓/✗ | |
| A03 Injection | ✓/✗ | |
...

### Vulnerabilities Found
| ID | Description | CVSS | Severity |
|----|-------------|------|----------|
| V1 | [description] | X.X | High |
| V2 | [description] | X.X | Medium |

### Remediation Plan
1. **[V1]**: [fix] - Priority: Immediate
2. **[V2]**: [fix] - Priority: This sprint

### Security Posture
**Overall Risk: [Low/Medium/High/Critical]**

Quick Security Checklist

For rapid review:

Secure Coding Patterns

Input Validation

python

# Always validate and sanitize
def process_input(user_input):
    if not isinstance(user_input, str):
        raise ValueError("Invalid input type")
    if len(user_input) > MAX_LENGTH:
        raise ValueError("Input too long")
    sanitized = escape_html(user_input)
    return sanitized

SQL Injection Prevention

python

# NEVER concatenate
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")  # BAD

# ALWAYS parameterize
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))  # GOOD