Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Architecting Security · telagod | DecimalAI

telagod/architecting-security

SkillScore86Maintained

安全架构与治理：威胁建模 (STRIDE/PASTA/LINDDUN)、零信任身份架构、IAM/SSO/MFA/PAM、合规框架 (SOC2/PCI/HIPAA/GDPR)、DLP、隐私工程、安全控制设计。Use when designing security architecture, threat modeling new systems, implementing zero-trust identity, designing IAM/SSO/PAM, building compliance evidence chains, or planning privacy-by-design.

Securityby telagod

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/telagod-architecting-security/SKILL.md

decimalai skills pull telagod-architecting-security --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/telagod-architecting-security/SKILL.md https://app.decimal.ai/s/telagod-architecting-security/SKILL.md

Raw file: /s/telagod-architecting-security/SKILL.md ↗ · machine-readable summary at /s/telagod-architecting-security.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 29d ago

Yes — +27% lift · at higher cost+48% tokens0% turns86% of whole cases pass with skill (19/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	218%	0%
case-04	✗→✓	▲ Improved	2%	0%
case-06	✗→✓	▲ Improved	63%	0%
case-15	✗→✓	▲ Improved	57%	0%
case-16	✗→✓	▲ Improved	8%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

telagod / code-abyss

skills/architecting-security/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 3 files

Skill contents

references/

SKILL.md

安全架构与治理

> 判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核 skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。

> 架构是预防层，不是补丁。先建模再写代码，先定边界再开 API。控制必须可证据化。

路由

| 意图 | 秘典 | 核心 | |------|------|------| | 威胁建模 | threat-modeling | STRIDE / PASTA / LINDDUN / DFD / Attack Tree | | 身份与零信任 | identity-and-zero-trust | IAM / SSO / MFA / Kerberos / PAM / Conditional Access | | 合规与证据 | compliance-and-evidence | SOC2 / PCI / HIPAA / GDPR / ISO27001 / DLP / 隐私工程 |

何时使用

| 场景 | 用 | 不用 | |------|----|----| | 新系统设计 / 新攻击面引入 | ✅ STRIDE + DFD | — | | 重大架构变更（鉴权、数据流、信任边界）| ✅ 重新建模 | — | | 引入 PII / PHI / PCI 数据 | ✅ LINDDUN + 合规映射 | — | | 上线前安全门禁 / 客户安全问卷 | ✅ 控制矩阵 + 证据 | — | | 已有架构无变更 | ❌ | 用现有控制即可 | | 仅 bug 修复 / 样式调整 | ❌ | 走 analyzing-security | | 渗透实施层面 | ❌ | 用 securing-systems |

执行链

威胁建模 (STRIDE/PASTA/LINDDUN)
  → 控制设计 (preventive / detective / responsive 三层)
  → 实现 (代码、IaC、policy-as-code)
  → 验证 (渗透 / 红队 / 控制测试)
  → 证据留痕 (日志 / 审计 / 合规映射)

每环必须可回答「这控制对应哪条威胁？这威胁缓解到什么残留水平？谁验收？」

决策矩阵

| 决策点 | 选项 A | 选项 B | 判据 | |--------|--------|--------|------| | 鉴权协议 | SAML 2.0 | OIDC | 企业内部 SSO → SAML；移动/SPA/API → OIDC | | MFA 强度 | TOTP / Push | FIDO2 / WebAuthn | 高价值账号、抗钓鱼 → FIDO2 强制 | | 特权访问 | Standing privilege | JIT + Approval | 生产/敏感 → JIT；运维便利 → Standing 必有补偿 | | 合规起步 | SOC 2 Type I | Type II | 客户问卷应付 → I；正式审计 → II（6-12月观察期）| | 数据脱敏 | 假名化（可逆）| 匿名化（不可逆）| 业务侧仍需关联 → 假名化 + KMS；统计/共享 → 匿名化 | | 跨境传输 | SCC | BCR | 偶发场景 → SCC；跨国集团内部 → BCR |

与其他 skill 联动

威胁建模产出 → analyzing-security 把高危项纳入扫描规则
代码层防御 → securing-systems（pentest / code-audit / red-team）
IaC 策略落地 → provisioning-infrastructure（OPA / Sentinel / Conftest）
LLM/Agent 系统威胁 → building-agent-systems（Prompt Injection / 模型窃取）
API 接口面 → designing-architectures 的 api-design.md
审计证据自动化 → automating-devops（CI 持续合规）

铁律

先建模再写代码 — 威胁清单未出，代码不动；信任边界未画，接口不开。
控制必须证据化 — 任何控制都要回答「日志在哪？审计点在哪？谁是 owner？SLA 多久？」
零信任默认拒绝 — 永不信任、始终验证、最小权限到请求级；缺一即非零信任。
合规不是法律意见 — 框架映射可以做，最终结论须法务/合规官签字。
残留风险必须留痕 — 不能消的风险要在 DESIGN.md / 风险登记册显式接受 + 补偿控制。

Illustrative Want to see what telagod/architecting-security would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/24/2026, 19:15 UTC · 22 cases

Lift

+27%

86% vs 59%

Agent turns

1.0 vs 1.0

Tokens

+48%

2,997.86 vs 2,020.59

fail → pass · 6pass → pass · 13fail → fail · 3

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 我们准备推出一款面向手机端和 Web 端的新版客户服务系统，后端包含数十个微服务 API，并涉及敏感数据传输。请针对这个新系统制定完整的安全架构与治理方案，要求给出威胁建模框架建议、身份认证与特权访问方案的选择评估、以及从建模到证据留痕的完整执行链说明。	fail→fail	26,362	35,491	+35%	1	1	0%	3,883	5,368	+38%	0	0	—
case-02 A security scanner flagged a SQL injection vulnerability in our legacy Express user login controller code at 'src/controllers/auth.js'. Please provide the exact Node.js code fix to sanitize the database query.	fail→fail	7,281	8,109	+11%	1	1	0%	1,351	2,609	+93%	0	0	—
case-03 We need to test the firewall rules on our staging cluster at 192.168.1.50. Run nmap port scans and attempt SQL injection exploitation against port 8080 to check for active vulnerabilities.	fail→pass	6,597	8,638	+31%	1	1	0%	578	1,836	+218%	0	0	—
case-04 Our payment processing service is deploying a minor bug fix patch release with no changes to data flows, external API schemas, or trust boundaries. What threat modeling steps should we execute before deployment?	fail→pass	16,639	8,007	-52%	1	1	0%	2,264	2,305	+2%	0	0	—
case-05 We are architecting authentication for a new native React Native mobile app and Vue.js Single Page Application connecting to cloud microservice APIs. The infrastructure team recommends SAML 2.0 because it is enterprise standard. Which authentication protocol should we implement?	pass→pass	14,088	8,862	-37%	1	1	0%	2,231	2,553	+14%	0	0	—
case-06 We are integrating an internal employee HR portal with our corporate Active Directory identity provider for employee login. The lead developer suggests using custom OAuth2 bearer tokens. Which protocol should be chosen?	fail→pass	11,018	10,650	-3%	1	1	0%	1,673	2,728	+63%	0	0	—
case-07 We are configuring authentication for infrastructure engineers accessing AWS master billing accounts and core Kubernetes clusters. Staff proposed using standard SMS codes or authenticator apps. What MFA mechanism should be required?	pass→pass	13,661	10,377	-24%	1	1	0%	2,024	2,664	+32%	0	0	—
case-08 Site Reliability Engineers need database access to troubleshoot live production issues. SRE leadership wants standing SSH and database admin access for speed during incidents. How should privilege access be designed?	pass→pass	16,331	20,216	+24%	1	1	0%	2,456	4,111	+67%	0	0	—
case-09 A legacy backend batch processing service cannot support temporary session elevation and requires permanent standing privileges on production database instances. What governance requirement applies?	pass→pass	10,405	12,173	+17%	1	1	0%	1,537	3,024	+97%	0	0	—
case-10 A prospective enterprise client sent an urgent vendor questionnaire demanding security audit proof within 3 weeks. The company has never undergone an external audit. Should we aim for SOC 2 Type I or Type II?	pass→pass	16,315	11,256	-31%	1	1	0%	2,418	2,786	+15%	0	0	—
case-11 Our fintech firm is preparing for formal institutional audit verification covering operations over a 12-month period to prove sustained control effectiveness. Which compliance framework audit level is appropriate?	pass→pass	14,378	10,470	-27%	1	1	0%	2,041	2,728	+34%	0	0	—
case-12 The business intelligence team needs customer dataset extracts to generate aggregate quarterly market reports. They requested reversible encryption keys so they can decrypt emails if needed. Which masking technique should be applied?	fail→fail	9,205	14,051	+53%	1	1	0%	1,353	3,111	+130%	0	0	—
case-13 Customer service reps need to search anonymized support ticket logs and link them back to account records in database tables using managed encryption keys. Which data masking pattern is appropriate?	pass→pass	9,123	9,735	+7%	1	1	0%	1,326	2,489	+88%	0	0	—
case-14 A multinational corporation needs to set up ongoing corporate transfers of European employee records between its EU operating subsidiaries and US parent headquarters. Which cross-border transfer mechanism fits best?	pass→pass	14,044	16,009	+14%	1	1	0%	2,136	3,564	+67%	0	0	—
case-15 An e-commerce firm needs to perform a one-time export of customer support records to a third-party vendor located in Canada for a short-term data analysis contract. Which transfer mechanism should be used?	fail→pass	10,542	9,759	-7%	1	1	0%	1,664	2,605	+57%	0	0	—
case-16 After completing threat modeling for a cloud financial service, we are designing the control architecture layer. How should security controls be structured across the operational lifecycle?	fail→pass	22,192	14,302	-36%	1	1	0%	3,209	3,475	+8%	0	0	—
case-17 The development team wants to begin coding microservice endpoints for a new health records platform before threat modeling and trust boundary mapping are completed to meet a launch deadline. How should security governance respond?	fail→pass	14,648	15,555	+6%	1	1	0%	2,039	3,162	+55%	0	0	—
case-18 An API gateway architecture permits internal microservice-to-microservice traffic without validating authorization scopes, relying on perimeter network protection. Does this satisfy zero trust requirements?	pass→pass	10,296	11,000	+7%	1	1	0%	1,557	2,607	+67%	0	0	—
case-19 Engineering drafted a technical mapping table linking SOC 2 controls to AWS configurations and plans to distribute it to enterprise clients as official legal compliance verification. What rule applies?	pass→pass	14,416	5,608	-61%	1	1	0%	1,712	1,981	+16%	0	0	—
case-20 We are introducing an external webhook ingestion service into our cloud architecture. Which specific modeling approach should be used to analyze this new attack surface?	pass→pass	16,558	13,246	-20%	1	1	0%	2,416	3,254	+35%	0	0	—
case-21 We want to enforce cloud infrastructure security controls automatically inside our Terraform deployment pipelines. Which tooling mechanism should be integrated?	pass→pass	12,273	12,162	-1%	1	1	0%	2,032	3,158	+55%	0	0	—
case-22 Our architecture team is designing an autonomous AI agent system that accepts user prompts and executes database queries. What primary LLM-specific security threats must be mitigated in the design?	pass→pass	17,646	18,130	+3%	1	1	0%	2,553	3,835	+50%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +27 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 59.1%
Pass rate with the skill: 86.4%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/24/2026, 19:15 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

We need to test the firewall rules on our staging cluster at 192.168.1.50. Run nmap port scans and attempt SQL injection exploitation against port 8080 to check for active vulnerabilities.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run86

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+47% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 29 days ago

Other measured skills in the registry, with their headline benchmark lift.