Architecting Security

This is your pre-code security design layer. It pushes you to run STRIDE, PASTA, or LINDDUN threat modeling before you ship new systems or cross trust boundaries, then map controls to SOC2, PCI, HIPAA, or GDPR requirements with evidence chains. The routing splits cleanly into threat modeling, identity and zero trust (IAM, SSO, MFA, PAM), and compliance artifacts. The decision matrix is sharp: SAML for enterprise SSO, OIDC for APIs and mobile; FIDO2 when phishing is a real threat; JIT privilege access for production. The iron law is worth repeating: threat list before code, controls must be evidence-backed, and residual risk goes in the design doc with explicit acceptance. It won't write policies for you, but it'll make you answer the right questions before your next security questionnaire lands.

GitHub stars: 224
last updated: Jun 10, 2026

View on GitHub

Install

$ npx -y skills add telagod/code-abyss --skill architecting-security --agent claude-code

Installs into .claude/skills of the current project.

Files

安全架构与治理

判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核 skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。

架构是预防层，不是补丁。先建模再写代码，先定边界再开 API。控制必须可证据化。

路由

意图	秘典	核心
威胁建模	threat-modeling	STRIDE / PASTA / LINDDUN / DFD / Attack Tree
身份与零信任	identity-and-zero-trust	IAM / SSO / MFA / Kerberos / PAM / Conditional Access
合规与证据	compliance-and-evidence	SOC2 / PCI / HIPAA / GDPR / ISO27001 / DLP / 隐私工程

何时使用

场景	用	不用
新系统设计 / 新攻击面引入	✅ STRIDE + DFD	—
重大架构变更（鉴权、数据流、信任边界）	✅ 重新建模	—
引入 PII / PHI / PCI 数据	✅ LINDDUN + 合规映射	—
上线前安全门禁 / 客户安全问卷	✅ 控制矩阵 + 证据	—
已有架构无变更	❌	用现有控制即可
仅 bug 修复 / 样式调整	❌	走 analyzing-security
渗透实施层面	❌	用 securing-systems

执行链

威胁建模 (STRIDE/PASTA/LINDDUN)
  → 控制设计 (preventive / detective / responsive 三层)
  → 实现 (代码、IaC、policy-as-code)
  → 验证 (渗透 / 红队 / 控制测试)
  → 证据留痕 (日志 / 审计 / 合规映射)

SKILL.md on GitHub