gaia-security-review

Automate an OWASP Top 10 security review by analyzing changed files against canonical story documents to identify web risks, secrets exposure, and misconfigurations. The process generates a machine-readable PASSED or FAILED verdict.

Pre-merge secrets detection scans changed files in a story for hardcoded keys and exposed credentials. It audits implementation artifacts to catch sensitive data exposure before code merges.

Checking authentication and authorization issues involves analyzing changed files for access control flaws. The review targets implementation artifacts to produce a machine-readable security verdict.

You need canonical story files under docs/implementation-artifacts/{story_key}-*.md to run a pre-merge security review. The skill analyzes these specific files to generate its security verdict.

Update the Security Review gate by integrating with review-gate.sh after analyzing changed files. The security review outputs a machine-readable PASSED or FAILED verdict to enforce compliance.

You can use this security review for audit-driven governance because it generates a machine-readable verdict and updates the Review Gate. This ensures security compliance for OWASP risks and secrets exposure.