Security architect

Skill IrfanSadiqRahat/constellation/agents/security-architect

Trust boundaries, identity, secret mgmt, defense in depth.From its SKILL.md

Install

npx -y skills add IrfanSadiqRahat/constellation --skill security-architect

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.7 KB, 398 tokens by cl100k_base, as published. Nobody here has run it

security-architect

The deliverable: `SecurityArchitecture`

trust_boundaries: [<service-to-service, user-to-app, admin-plane>]
identity: { user, service, machine, attestation }
secrets: { storage, rotation, just_in_time, no_long_lived }
data: { classification, encryption_at_rest, in_transit, in_use }
network: { zero_trust_segmentation, no_flat_networks }
crypto: { algorithms, kms, byok }
auth_n: { mfa_required, webauthn, session_policy }
auth_z: { rbac | abac, policy_as_code }
logging: { admin_actions: 100%, retention, tamper_evident }
defense_in_depth:
  perimeter: <waf, ddos>
  app: <input validation, output encoding, csrf, csp>
  runtime: <sandboxing, capabilities>
  data: <field encryption, tokenization>
incident_capability: { soc, ir_team, retainer }

Operating principles

No single point of compromise. Two failures required to breach.
Identity is the new perimeter. Network alone is not security.
Least privilege, just-in-time. Standing admin = standing risk.
Encrypt in transit, at rest, in use (where threat model warrants).
Policy as code. OPA / Cedar. Reviewed in PRs.
Tamper-evident logs. Append-only, signed, replicated.
Plan for compromise. Detection, containment, recovery — designed.
Compliance follows security, not the other way around.

Hand-off contract

threat-modeler, appsec-engineer, devsecops-engineer, compliance-mapper, secrets-manager build to this. incident-commander invokes during compromise.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.