Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →nwave-ai/nw-security-by-design
Security design principles, STRIDE threat modeling, OWASP Top 10 architectural mitigations, and secure patterns. Load when designing systems or reviewing architecture for security.
Passed 20 of 23 test cases with the skill, and 16 of 23 without it.
and 2 more in the full report
4 fixed16 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
An internal payment gateway service encounters an unhandled runtime error while communicating with a third-party fraud scoring API. Developers suggest defaulting to 'ALLOW' when the fraud API is unreachable to prevent transaction drops, and shipping the default server configuration with debug mode enabled. How should Fail Secure and Security by Default principles be applied here?
| Checked | Without skill | With skill |
|---|---|---|
| Mandates denying access or blocking transactions on error | Missed | Passed |
| Mandates shipping restrictive defaults by default with explicit opt-in for relaxed settings | Passed | Passed |
The instructions your model reads when the skill loads.
Apply these during design -- retrofitting security is 10-100x more expensive.
| # | Principle | Architect Action |
|---|---|---|
| 1 | Security by Design | Include security requirements in architecture documents |
| 2 | Security by Default | Ship restrictive defaults; require explicit opt-in for relaxed settings |
| 3 | Defense in Depth | Layer controls: WAF + input validation + output encoding + parameterized queries |
| 4 | Fail Secure | Deny access on error; closed-by-default network policies |
| 5 | Least Privilege | Scoped service accounts; time-limited tokens; minimum permissions |
| 6 | Compartmentalize | Network segmentation; separate databases per trust level |
| 7 | Separation of Duties | Separate deployment approval from code authorship |
| 8 | Economy of Mechanism | Minimize attack surface; simple, auditable security code |
| 9 | Complete Mediation | Check authorization on every request; no cached auth decisions |
| 10 | Open Design | Use published, peer-reviewed algorithms; no security-through-obscurity |
| 11 | Least Common Mechanism | Separate admin and user interfaces |
| 12 | Psychological Acceptability | Make the secure path the easy path; minimize user friction |
Apply STRIDE to every component in a Data Flow Diagram (DFD). Four questions drive every session:
| Threat | Violated Property | Architectural Mitigation |
|---|---|---|
| Spoofing | Authentication | MFA, mutual TLS, certificate pinning, OAuth2+PKCE |
| Tampering | Integrity | Input validation, HMAC, parameterized queries, immutable infra |
| Repudiation | Non-repudiation | Tamper-evident logging (append-only), digital signatures, SIEM |
| Info Disclosure | Confidentiality | Encryption at rest+transit, least privilege, generic error messages |
| Denial of Service | Availability | Rate limiting, circuit breakers, auto-scaling, query complexity limits |
| Elevation of Privilege | Authorization | Least privilege, RBAC/ABAC, signed tokens verified server-side |
test cases passed, vs 16 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.