/design-review
Run a secure-by-design architecture review — threat model, trust boundaries, control selection, and a documented verdict.
$ npx -y skills add jassics/awesome-claude-security --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/design-review
Context preview
What this command does when you run it.
Run a secure-by-design architecture review — threat model, trust boundaries, control selection, and a documented verdict.
Command definition
design-review.mddescription: Run a secure-by-design architecture review — threat model, trust boundaries, control selection, and a documented verdict. argument-hint: [system / design doc / service to review]
Run a security design review for: **$ARGUMENTS**
Walk the review, using installed skills (note any whose plugin is missing):
1. **Understand the design** — `/security-architect:security-design-review` to map components, data flows, and trust boundaries. 2. **Model threats** — `/threat-modeling:stride` (or `/threat-modeling:pasta` for a richer process) against each trust boundary. 3. **Diagram** — `/security-diagramming:threat-model-dfd` and/or `/security-diagramming:architecture-diagram` to make the boundaries and threats explicit. 4. **Select controls** — map each significant threat to a control; `/threat-modeling:risk-rank` to prioritize; reference `/security-knowledge:framework-mapping` to align controls to NIST/ISO/CIS. 5. **Report** — a design-review verdict with required/recommended controls and residual risk; use `/security-reporting:executive-summary` for the leadership view.
For deep execution, hand off to the `security-architect` agent. Push fixes left into the design — a control chosen now is cheaper than a finding later.
A Claude Code plugin marketplace for the full cybersecurity & GenAI-security lifecycle — from recon and threat modeling to detection engineering, GRC, and CISO-level strategy. A pentester knows which OWASP test bends a broken-access-control endpoint.
Repo: jassics/awesome-claude-security
Other commands on awesome-claude-security.
- /safety-review
Run an AI safety review for a feature/model — harms, evaluations, guardrails, and a documented safety case.
Open command - /defend
Run a threat-informed defense cycle for a technique or threat — coverage check, hunt, detection, and purple-team validation.
Open command - /board-brief
Build a board/executive security brief — strategy, quantified risk, and a board-ready deck.
Open command - /tech-review
Assess technology/security risk for a strategic decision and frame the secure-by-design path.
Open command - /precommit
Run the pre-commit security gate on the current changeset and report a single pass/fail verdict.
Open command - /assessment
Run a compliance gap-assessment for a framework, tie gaps to risk, and produce findings + remediation.
Open command