TeamEngineering · v1.1.0
Security & AppSec Team
Defensive Sicherheit — Threat Modelling, sicheres Code Review, Supply-Chain-Risiko, Incident Response und Mapping auf SOC 2 / ISO 27001 / NIS2 / DORA.
Threat modelling, secure code review, supply chain risk, incident response and compliance mapping.
Reviews start with object-level authorisation, because that is the defect that shows up most and costs most. Dependency findings are triaged by reachability with the reasoning shown — never raw scanner output.
Defensive only: no exploit code, no attack tooling.
Agenten 5
- 01
compliance-mapperUse to map security controls to frameworks — SOC 2, ISO 27001, NIS2, DORA and customer security questionnaires — producing gap analyses, evidence lists and readiness plans. - 02
dependency-risk-analystUse for supply chain security — dependency and container image auditing, vulnerability triage, licence compliance, SBOM production and reducing exposure to third-party code. - 03
secure-code-reviewerUse to review code for security defects — injection, authorisation gaps, authentication and session flaws, secret handling, cryptography misuse, unsafe deserialisation and insecure defaults. Defensive review only. - 04
security-incident-responderUse during and after suspected security incidents — containment, evidence preservation, scope assessment, remediation and breach notification analysis. Defensive response only. - 05
threat-modelerUse to threat model a system or feature — identifying assets, trust boundaries, attack surface and realistic threats, and specifying the controls that address them. Defensive analysis only.
Skills 2
- 01
appsec-reviewRun a security review of a codebase or change — authorisation, authentication, injection, input handling, secrets, cryptography, configuration and business logic — with severity-ranked findings and fixes. Defensive review only. - 02
threat-modelingThreat model a system or feature — assets, trust boundaries, concrete threat scenarios, existing controls, gaps and a ranked control plan. Defensive analysis only. Use when asked to threat model, assess security design, or review a feature for security risk.
Befehle 2
- 01
/security-reviewSecurity review a codebase, service or pull request and return severity-ranked findings with fixes and verification. - 02
/threat-modelThreat model a system or feature and return ranked threats with a control plan. Defensive analysis only.
Was dieses Team nicht tut
No exploit code, proof-of-concept attacks, evasion techniques or unauthorised-access tooling — findings are described precisely enough to fix and to regression-test, and no further. No assessing systems you do not own. No claiming a certification or control the organisation does not have. No writing audit evidence retrospectively. And no pasting raw scanner output as a finding list — every dependency finding is triaged by reachability with the reasoning shown.
- hirre-security-appsec-team/
- .claude-plugin/marketplace manifest
- marketplace.json
- plugins/
- security-appsec-team/
- .claude-plugin/plugin manifest
- plugin.jsonname, version, author
- agents/the specialists
- compliance-mapper.md
- dependency-risk-analyst.md
- secure-code-reviewer.md
- security-incident-responder.md
- threat-modeler.md
- commands/slash commands that run the team
- security-review.md
- threat-model.md
- skills/shared workflows
- appsec-review/
- SKILL.md
- threat-modeling/
- SKILL.md
- HANDBOOK.mdinstall · tune for quality · tune for cost
- README.mdwhat it does, how to use it
- README.mdinstall in two lines
- LICENSE
unzip hirre-security-appsec-team-1.1.0.zip
/plugin marketplace add ./hirre-security-appsec-team
/plugin install security-appsec-team@hirre-security-appsec- v1.3.004. Sept. 2026
- Every team now ships a HANDBOOK.md: install, tune for quality, tune for cost.
- v1.0.003. Sept. 2026
- Security & AppSec Team joins the catalogue.
→ Kollegen
Ebenfalls einstellenswert
Migration & SEO Team
Replatforming, das den Traffic behält: Migrationsarchitektur, Plattform-Engineers für Shopify, WordPress/WooCommerce und PrestaShop/Magento, technisches SEO, Content- und URL-Mapping, Analytics- und Search-Console-Kontinuität, internationales SEO.
Product Engineering Team
Ein komplettes Software-Team — Architektur, Backend, Frontend, Datenbank, Code Review und QA — mit Design-Doc- und Code-Review-Workflows.
DevOps & SRE Team
CI/CD, Infrastructure as Code, Observability und SLOs, Incident Command und Release-Management, mit Runbook- und Incident-Response-Workflows.