What problem does it solve? Repositories often lack clear security policy guidance, leaving security scanners and reviewers without context about system boundaries, threat models, reportable findings, and accepted risks. This Skill creates and maintains SECURITY.md files that tell security review tooling exactly what matters. ## Core Features & Use Cases - Policy Discovery and Resolution: Inventories existing SECURITY.md files across a repository, including nested component policies, and resolves the applicable policy chain from root to leaf. - Boundary and Threat Model Definition: Establishes system scope, trust boundaries, attacker-controlled inputs, security invariants, and severity context based on source code, tests, and prior findings. - Reviewed Drafting Workflow: Drafts structured policy sections, shows exact diffs for approval, and verifies the result after writing. - Use Case: Before running a security scan on a multi-component repository, use this Skill to write a root SECURITY.md defining which surfaces are internet-facing and which finding classes are out of scope, so scan results are triaged against real risk. ## Quick Start Ask the assistant to define a security policy for this repository, covering the system boundary, threat model, and which findings should be reportable.
