ferrox-secure-phase

Verify security mitigations in completed phases and update SECURITY.md.

21|9|Updated Jul 21, 2026

Search Tags:#security review #software delivery #secure development #audit trail #threat mitigation #phase verification

Ready to run

npx skills add https://github.com/FerroxLabs/ferrox-factory --skill ferrox-secure-phase

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ferrox-secure-phase
Source: https://github.com/FerroxLabs/ferrox-factory/tree/main/skills/ferrox-secure-phase
Command: npx skills add https://github.com/FerroxLabs/ferrox-factory --skill ferrox-secure-phase

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps confirm that the threats identified for a finished phase were actually mitigated in the code, instead of merely being discussed or assumed resolved.

Core Features & Use Cases

Security mitigation verification: Checks whether a completed phase has an existing SECURITY.md and validates the recorded fixes.
Artifact-based auditing: When SECURITY.md is missing but PLAN.md includes a threat model, it reconstructs verification from available phase artifacts.
Phase completion guidance: If the phase was not executed, it stops and provides clear guidance rather than fabricating an audit.

Quick Start

Use the ferrox-secure-phase skill to verify the latest completed phase and update its SECURITY.md with confirmed threat mitigations.

Frequently Asked Questions about ferrox-secure-phase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify security mitigations were implemented in a completed development phase?▼

Security mitigation verification validates that threats identified for a finished phase were actually mitigated in the code. It cross-references recorded fixes against phase artifacts to confirm resolutions rather than assumptions.

What is threat-model traceability in phase-based software delivery?▼

Threat-model traceability links identified threats to their corresponding code mitigations and documentation. It ensures auditability by requiring evidence in SECURITY.md or PLAN.md to validate post-implementation security fixes.

Can I audit phase security fixes if my project is missing a SECURITY.md file?▼

You can audit phase security fixes without a SECURITY.md file if PLAN.md includes a threat model. The verification process reconstructs validation from available phase artifacts to maintain auditability.

How do I document an audit trail for secure development workflows?▼

To document an audit trail for secure development workflows, validate completed phase mitigations and update SECURITY.md with confirmed threat resolutions. This preserves workflow gates while producing verifiable artifact evidence.

What happens if I run phase verification on a phase that was not executed yet?▼

Running phase verification on an unexecuted phase stops the process and provides clear guidance rather than fabricating an audit. It prevents false validation by requiring actual implementation evidence.