Security Team
Spawn a 3-agent security review team (Static Analyzer + Dependency Auditor + Threat Modeler) for pre-deploy security gates.
How It Works
- Security review / pre-deploy: Threat model, dependency audit, or pre-deploy gate
- Scope the surface: Changed files · critical paths · stack & packages
- Spawn 3 agents
- Triage and act: Merge by severity · resolve P0s · open CVE upgrade PRs
- Security gate: P0s resolved · 0 Critical CVEs · threat model committed
- Review + threat-model.md: Findings by severity · mitigations · docs/security/threat-model.md
Invocation Triggers
/security-teamsecurity reviewthreat modeldependency auditpre-deploy securityUse Cases
- Pre-deploy security gate before launching a new service
- Dependency audit for a third-party package adoption
- Threat model a new authentication or payment flow
The Problem
Solo security reviews scan for the thing you happened to remember to look for. You grep for secrets, glance at npm audit, and call it clean — while the IDOR in the auth flow and the abandoned dependency fetching remote code at install time both sail through. A pre-deploy gate that only catches what one tired engineer thought of at 6pm is not a gate. It is a feeling.
What It Does
- 1Define the scope
Identify the changed surface (git diff main...HEAD), the critical paths (auth, payments, data access, external calls), and the stack. Scope is agreed explicitly, not assumed — changed files can still call unchanged vulnerable code.
- 2Spawn all 3 agents in parallel
Static Analyzer (sonnet) hunts OWASP Top 10, secrets, and unsanitized sinks. Dependency Auditor (sonnet) runs npm/pip/cargo audit and assesses real exploitability. Threat Modeler (opus) maps the attack surface and runs STRIDE on the critical flows.
- 3Static analysis with P0 self-fix
The Static Analyzer scans for injection, broken auth, XSS, IDOR, hardcoded keys, dangerouslySetInnerHTML without sanitization, and string-built SQL. Actively exploitable P0s get fixed inline; P1/P2 are documented with file:line and remediation.
- 4Dependency and CVE audit
Critical and High CVEs get researched for actual exploitability in this codebase — not just a raw audit dump. Abandoned packages and remote-fetching installers are flagged separately, because they never show up in npm audit output.
- 5Threat model and persist
The Threat Modeler maps entry points and trust boundaries, ranks the highest-risk paths, and writes the model to docs/security/threat-model.md. An in-context report that never gets committed is lost on the next session.
- 6Triage and gate
Findings merge by severity. P0s resolve immediately, Critical/High CVEs get upgrade PRs, and the gate prints PASS or FAIL with explicit counts. Identified risks with no mitigation are never a PASS.
What You Get / What It Doesn't Do
- Severity-merged findings table with file:line and remediation per item
- P0 vulnerabilities fixed inline, each with a regression test
- CVE upgrade PRs for Critical and High dependencies
- A committed docs/security/threat-model.md with the ranked attack surface
- A PASS/FAIL gate line with explicit P0, P1, and CVE counts
- Accept an identified risk without your explicit sign-off
- Replace a full audit swarm — this is security-only, by design
- Auto-merge dependency upgrade PRs — you review the version bumps
- Guarantee zero vulnerabilities — it covers known patterns and CVEs, not unknowns
Tips
An agent fixing its own work is not an independent check. Run the test suite after any Static Analyzer P0 fix and confirm a regression test exists.
A clean audit only means no known CVEs. The abandoned package and the install-time remote fetch never appear there — that is exactly what the Dependency Auditor exists to catch.
The Threat Modeler listing risks is half the job. Either implement the mitigation or formally accept the risk with sign-off before you call the gate green.
Get the Skill
Unlock the full Security Team SKILL.md — drop it into ~/.claude/skills/ and trigger it by name.
- Severity-merged findings table with file:line and remediation per item
- P0 vulnerabilities fixed inline, each with a regression test
- CVE upgrade PRs for Critical and High dependencies
- A committed docs/security/threat-model.md with the ranked attack surface
Commonly Used With
29 more production skills ready to install.