Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Ask Secure By Design Questions · amariahak | DecimalAI

amariahak/Ask Secure By Design Questions

SkillScore86Maintained

You are an advanced AI specialized in securely building anything, from bridges to web applications. You deeply understand the fundamentals of secure design and the details of how to apply those fundamentals to specific situations.

Securityby amariahak

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/amariahak-ask-secure-by-design-questions/SKILL.md

decimalai skills pull amariahak-ask-secure-by-design-questions --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/amariahak-ask-secure-by-design-questions/SKILL.md https://app.decimal.ai/s/amariahak-ask-secure-by-design-questions/SKILL.md

Raw file: /s/amariahak-ask-secure-by-design-questions/SKILL.md ↗ · machine-readable summary at /s/amariahak-ask-secure-by-design-questions.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +64% lift+9% tokens0% turns86% of whole cases pass with skill (19/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	-15%	0%
case-02	✗→✓	▲ Improved	53%	0%
case-07	✗→✓	▲ Improved	27%	0%
case-08	✗→✓	▲ Improved	25%	0%
case-09	✗→✓	▲ Improved	-18%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/1/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

amariahak / atlarix-skills

skills/fabric-ask-secure-by-design-questions/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1

Skill contents

SKILL.md

Ask Secure By Design Questions

When to use this skill

Source

Synced from https://github.com/danielmiessler/fabric/tree/main/data/patterns/ask_secure_by_design_questions/system.md.

IDENTITY

You take input and output a perfect set of secure_by_design questions to help the builder ensure the thing is created securely.

GOAL

Create a perfect set of questions to ask in order to address the security of the component/system at the fundamental design level.

STEPS

Slowly listen to the input given, and spend 4 hours of virtual time thinking about what they were probably thinking when they created the input.

Conceptualize what they want to build and break those components out on a virtual whiteboard in your mind.

Think deeply about the security of this component or system. Think about the real-world ways it'll be used, and the security that will be needed as a result.

Think about what secure by design components and considerations will be needed to secure the project.

OUTPUT

In a section called OVERVIEW, give a 25-word summary of what the input was discussing, and why it's important to secure it.

In a section called SECURE BY DESIGN QUESTIONS, create a prioritized, bulleted list of 15-25-word questions that should be asked to ensure the project is being built with security by design in mind.

Questions should be grouped into themes that have capitalized headers, e.g.,:

ARCHITECTURE:

What protocol and version will the client use to communicate with the server?
Next question
Next question
Etc
As many as necessary

AUTHENTICATION:

Question
Question
Etc
As many as necessary

END EXAMPLES

There should be at least 15 questions and up to 50.

OUTPUT INSTRUCTIONS

Ensure the list of questions covers the most important secure by design questions that need to be asked for the project.

INPUT

INPUT:

Illustrative Want to see what amariahak/Ask Secure By Design Questions would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/4/2026, 09:16 UTC · 22 cases

Lift

+64%

86% vs 23%

Agent turns

1.0 vs 1.0

Tokens

+9%

3,034.82 vs 2,776.55

fail → pass · 16pass → pass · 3fail → fail · 1pass → fail · 2

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We are building a remote patient monitoring app that syncs wearable sensor data to a cloud backend. I need a comprehensive set of foundational security design questions to review during our architectural planning. Please provide a brief summary of the project and why securing it matters, then list a thorough set of prioritized security-by-design questions grouped under uppercase domain headers. Make sure each question is detailed enough to give clear context.	fail→pass	18,949	11,033	-42%	1	1	0%	3,277	2,799	-15%	0	0	—
case-02 Our team is designing a high-frequency algorithmic trading microservice architecture that interacts with financial exchanges via REST and WebSockets. To ensure we embed security from the ground up, give us a brief overview summarizing the system and its security criticalities, followed by a prioritized list of threat-focused design questions organized into capitalized thematic sections.	fail→pass	12,702	11,691	-8%	1	1	0%	1,953	2,985	+53%	0	0	—
case-03 I'm architecting an IoT smart lock management system where gateway hubs communicate with hardware locks over Zigbee and connect to AWS via MQTT. Can you write a summary section explaining what this system does and why securing it is crucial, followed by a categorized breakdown of security-by-design questions under capitalized group titles to evaluate our system design?	pass→pass	17,948	9,322	-48%	1	1	0%	2,922	2,412	-17%	0	0	—
case-04 We are building a multi-tenant SaaS CRM platform on AWS. Perform a full STRIDE threat model on our user authentication flow and list specific threat vectors and potential mitigations for spoofing and tampering.	pass→pass	27,477	13,080	-52%	1	1	0%	4,361	2,992	-31%	0	0	—
case-05 Review this Python Flask snippet for SQL injection vulnerabilities: `cursor.execute('SELECT * FROM users WHERE username = ' + user_input)`. Provide the corrected code using parameterized queries.	pass→fail	9,609	11,618	+21%	1	1	0%	1,195	2,869	+140%	0	0	—
case-06 Map our OAuth 2.0 and OIDC implementation details to SOC 2 Type II Trust Services Criteria for access control and logical security.	pass→fail	18,540	18,698	+1%	1	1	0%	3,235	2,953	-9%	0	0	—
case-07 We are designing a microservice backend that processes credit card transactions via Stripe API and stores customer profiles in PostgreSQL. Generate security design questions covering tokenization, key management, and API isolation.	fail→pass	13,899	15,971	+15%	1	1	0%	2,430	3,083	+27%	0	0	—
case-08 Our infrastructure team is deploying an Istio service mesh on Kubernetes to handle internal gRPC service communication. Provide architectural security design questions to evaluate mTLS and pod-to-pod authorization.	fail→pass	20,799	16,461	-21%	1	1	0%	3,185	3,984	+25%	0	0	—
case-09 We are building an automated GitHub Actions CI/CD pipeline that builds Docker images and deploys them to AWS EKS. Create secure design questions targeting supply chain security and secrets management.	fail→pass	15,468	9,829	-36%	1	1	0%	2,726	2,234	-18%	0	0	—
case-10 We are developing an iOS and Android mobile banking application utilizing Secure Enclave for biometric authentication and certificate pinning for API requests. Produce security design evaluation questions for this mobile platform.	fail→pass	20,548	14,974	-27%	1	1	0%	2,887	2,908	+1%	0	0	—
case-11 Our team is designing an edge-to-cloud telemetry ingest pipeline for autonomous vehicles transmitting CAN bus metrics over cellular networks to Kafka. Provide secure by design questions for message integrity and edge authentication.	fail→pass	17,305	15,082	-13%	1	1	0%	2,510	2,869	+14%	0	0	—
case-12 We are creating a HIPAA-compliant data lake on AWS S3 integrating electronic health records via HL7 FHIR APIs. Provide a structured set of design questions addressing field-level encryption and access audit logging.	fail→pass	19,344	9,596	-50%	1	1	0%	3,136	2,387	-24%	0	0	—
case-13 We are building a ground control station system that issues real-time navigation commands to autonomous flight drones over encrypted RF links. Formulate security design questions covering command replay prevention and telemetry protection.	fail→pass	15,092	10,803	-28%	1	1	0%	2,305	2,542	+10%	0	0	—
case-14 Designing an AWS AppSync GraphQL API backed by Lambda functions and DynamoDB for a real-time collaborative document editor. Supply security by design questions regarding query complexity depth and tenant isolation.	fail→pass	17,694	12,554	-29%	1	1	0%	2,750	2,992	+9%	0	0	—
case-15 We are architecting a Software-Defined Perimeter (SDP) solution to replace our legacy corporate VPN using WireGuard and SAML IdP authentication. Provide design questions for policy enforcement and device health attestation.	fail→fail	14,281	17,299	+21%	1	1	0%	2,348	4,513	+92%	0	0	—
case-16 Our fintech startup is building an enterprise MPC crypto asset custody platform with threshold signature schemes. Generate security-by-design evaluation questions for cryptographic key shard management and quorum controls.	pass→pass	20,460	10,892	-47%	1	1	0%	3,090	2,753	-11%	0	0	—
case-17 We are deploying a Retrieval-Augmented Generation system using LangChain, Vector DB, and enterprise document repositories. Formulate security design questions covering prompt injection defense, document permissions, and vector embedding leakage.	fail→pass	15,922	10,925	-31%	1	1	0%	2,549	2,541	-0%	0	0	—
case-18 Designing an operational technology data historian collecting sensor telemetry from PLC devices in power plants over Modbus TCP. Provide security design questions focusing on network segmentation and protocol gateway security.	fail→pass	17,880	9,991	-44%	1	1	0%	2,958	2,434	-18%	0	0	—
case-19 We are architecting a central Identity Provider bridge supporting OAuth2, OIDC, and SAML 2.0 federation across multiple enterprise entities. Generate secure design questions evaluating token signing, metadata validation, and session termination.	fail→pass	21,308	10,373	-51%	1	1	0%	3,301	2,669	-19%	0	0	—
case-20 Building a global edge caching service running custom WebAssembly filters for DDoS mitigation and dynamic request inspection. Provide security design questions for WASM runtime sandboxing and edge TLS termination.	fail→pass	15,168	18,806	+24%	1	1	0%	2,442	4,761	+95%	0	0	—
case-21 Designing an AMI smart electricity metering network utilizing wireless mesh connectivity backhauled to cloud ingestion gateways. Formulate secure design questions covering meter firmware verification and mesh key distribution.	fail→pass	20,041	10,696	-47%	1	1	0%	2,863	2,545	-11%	0	0	—
case-22 We are deploying sensitive analytics workloads into AWS Nitro Enclaves to process encrypted financial records without exposing data to the host OS. Generate secure-by-design questions for enclave attestation and KMS integration.	fail→pass	14,717	22,313	+52%	1	1	0%	2,661	4,541	+71%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +64 percentage points is the difference between those two pass rates over the 22 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 22.7%
Pass rate with the skill: 86.4%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 2
Skill version measured: v1
Run completed: 8/4/2026, 09:16 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

We are building a remote patient monitoring app that syncs wearable sensor data to a cloud backend. I need a comprehensive set of foundational security design questions to review during our architectural planning. Please provide a brief summary of the project and why securing it matters, then list a thorough set of prioritized security-by-design questions grouped under uppercase domain headers. Make sure each question is detailed enough to give clear context.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run86

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-21% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

amariahak/Ask Secure By Design Questions

SkillSafety

Source

Ask Secure By Design Questions

When to use this skill

Source

IDENTITY

GOAL

STEPS

OUTPUT

OUTPUT INSTRUCTIONS

INPUT

How this skill was measured

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Related skills