/security-hardening

description: "Orchestrate comprehensive security hardening with defense-in-depth strategy across all application layers"
argument-hint: "<target description> [--depth quick|standard|comprehensive] [--compliance owasp,soc2,gdpr,hipaa,pci-dss]"

Security Hardening Orchestrator

CRITICAL BEHAVIORAL RULES

You MUST follow these rules exactly. Violating any of them is a failure.

1. **Execute steps in order.** Do NOT skip ahead, reorder, or merge steps. 2. **Write output files.** Each step MUST produce its output file in `.security-hardening/` before the next step begins. Read from prior step files — do NOT rely on context window memory. 3. **Stop at checkpoints.** When you reach a `PHASE CHECKPOINT`, you MUST stop and wait for explicit user approval before continuing. Use the AskUserQuestion tool with clear options. 4. **Halt on failure.** If any step fails (agent error, test failure, missing dependency), STOP immediately. Present the error and ask the user how to proceed. Do NOT silently continue. 5. **Use only local agents.** All `subagent_type` references use agents bundled with this plugin or `general-purpose`. No cross-plugin dependencies. 6. **Never enter plan mode autonomously.** Do NOT use EnterPlanMode. This command IS the plan — execute it.

Pre-flight Checks

Before starting, perform these checks:

1. Check for existing session

Check if `.security-hardening/state.json` exists:

• If it exists and `status` is `"in_progress"`: Read it, display the current step, and ask the user:

  Found an in-progress security hardening session:
  Target: [target from state]
  Current step: [step from state]

  1. Resume from where we left off
  2. Start fresh (archives existing session)

• If it exists and `status` is `"complete"`: Ask whether to archive and start fresh.

2. Initialize state

Create `.security-hardening/` directory and `state.json`:

{
  "target": "$ARGUMENTS",
  "status": "in_progress",
  "depth": "comprehensive",
  "compliance_frameworks": ["owasp"],
  "current_step": 1,
  "current_phase": 1,
  "completed_steps": [],
  "files_created": [],
  "started_at": "ISO_TIMESTAMP",
  "last_updated": "ISO_TIMESTAMP"
}

Parse `$ARGUMENTS` for `--depth` and `--compliance` flags. Use defaults if not specified.

3. Parse target description

Extract the target description from `$ARGUMENTS` (everything before the flags). This is referenced as `$TARGET` in prompts below.

---

Phase 1: Assessment & Threat Modeling (Steps 1–3)

Step 1: Vulnerability Scanning

Use the Task tool to launch the security auditor agent:

Task:
  subagent_type: "security-scanning-security-auditor"
  description: "Comprehensive vulnerability scan of $TARGET"
  prompt: |
    Perform a comprehensive security assessment on: $TARGET.

    ## Instructions
    1. Execute SAST analysis (Semgrep/SonarQube patterns)
    2. Identify DAST scanning targets (OWASP ZAP patterns)
    3. Perform dependency audit (Snyk/Trivy patterns)
    4. Run secrets detection (GitLeaks/TruffleHog patterns)
    5. Generate SBOM for supply chain analysis
    6. Identify OWASP Top 10 vulnerabilities, CWE weaknesses, and CVE exposures
    7. Assign CVSS scores to all findings

    Provide a detailed vulnerability report with: CVSS scores, exploitability analysis,
    attack surface mapping, secrets exposure report, and SBOM inventory.

Save the agent's output to `.security-hardening/01-vulnerability-scan.md`.

Update `state.json`: set `current_step` to 2, add step 1 to `completed_steps`.

Step 2: Threat Modeling & Risk Analysis

Read `.security-hardening/01-vulnerability-scan.md` to load vulnerability context.

Use the Task tool to launch the threat modeling expert:

Task:
  subagent_type: "threat-modeling-expert"
  description: "Threat modeling and risk analysis for $TARGET"
  prompt: |
    Conduct threat modeling using STRIDE methodology for: $TARGET.

    ## Vulnerability Context
    [Insert full contents of .security-hardening/01-vulnerability-scan.md]

    ## Instructions
    1. Analyze attack vectors and create attack trees
    2. Assess business impact of identified vulnerabilities
    3. Map threats to MITRE ATT&CK framework
    4. Prioritize risks based on likelihood and impact
    5. Use vulnerability scan results to inform threat priorities

    Provide: threat model diagrams, risk matrix with prioritized vulnerabilities,
    attack scenario documentation, and business impact analysis.

Save the agent's output to `.security-hardening/02-threat-model.md`.

Update `state.json`: set `current_step` to 3, add step 2 to `completed_steps`.

Step 3: Architecture Security Review

Read `.security-hardening/01-vulnerability-scan.md` and `.security-hardening/02-threat-model.md`.

Use the Task tool:

Task:
  subagent_type: "general-purpose"
  description: "Architecture security review for $TARGET"
  prompt: |
    You are a backend security architect. Review the architecture for security weaknesses in: $TARGET.

    ## Vulnerability Scan Results
    [Insert contents of .security-hardening/01-vulnerability-scan.md]

    ## Threat Model
    [Insert contents of .security-hardening/02-threat-model.md]

    ## Instructions
    1. Evaluate service boundaries, data flow security, authentication/authorization architecture
    2. Review encryption implementation and network segmentation
    3. Design zero-trust architecture patterns where applicable
    4. Create a data classification matrix
    5. Reference the threat model and vulnerability findings in your recommendations

    Provide: security architecture assessment, zero-trust design recommendations,
    service mesh security requirements, and data classification matrix.

Save the agent's output to `.security-hardening/03-architecture-review.md`.

Update `state.json`: set `current_step` to "checkpoint-1", add step 3 to `completed_steps`.

---

PHASE CHECKPOINT 1 — User Approval Required

You MUST stop here and present