gsd-secure

Audit code, configuration, and infrastructure changes against OWASP security best practices.

6|3|Updated Mar 31, 2026

Search Tags:#security #owasp #defense-in-depth #review #security-audit #gated

Ready to run

npx skills add https://github.com/alo-exp/silver-bullet --skill gsd-secure

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gsd-secure
Source: https://github.com/alo-exp/silver-bullet/tree/main/skills/gsd-secure
Command: npx skills add https://github.com/alo-exp/silver-bullet --skill gsd-secure

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security audits of code changes, enforcing defense in depth and OWASP best practices to prevent insecure deployments.

Core Features & Use Cases

Security touchpoint identification: From REVIEW.md or diffs, identify files handling authentication/authorization, data persistence, external API calls, user input, file I/O, and secrets.
Checklist execution: Run a structured security checklist addressing input validation, parameterized queries, output encoding, auth/authz, and secret management.
SECURITY.md gating: Verify or generate a SECURITY.md with a PASS gate and track findings for CRITICAL issues.

Quick Start

Run a security review on the latest changes and generate a PASS-ready SECURITY.md.

Frequently Asked Questions about gsd-secure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate an OWASP security audit for code changes before release?▼

Automate an OWASP security audit by running structured checklists against code diffs to enforce defense-in-depth. The review identifies security touchpoints like authentication, data persistence, and external API calls, tracking critical findings before shipping.

What is a SECURITY.md PASS gate in a pre-release security review?▼

A SECURITY.md PASS gate is a formal security artifact verifying that critical findings from a code review are remediated before deployment. It tracks defense-in-depth checklist results, enabling developers and release engineers to block insecure shipments.

How do I identify security touchpoints like input validation and secret management in my code?▼

Identify security touchpoints by analyzing REVIEW.md or file diffs to locate authentication, user input handling, file I/O, and external API calls. A structured security checklist then validates input validation, parameterized queries, and secret management across these areas.

Does a defense-in-depth security review cover infrastructure and configuration changes?▼

Yes, a defense-in-depth security review covers infrastructure and configuration changes alongside code modifications. It applies OWASP best practices across all pre-release changes to prevent insecure deployments and ensure comprehensive audit coverage.

Do I need a formal security checklist to enforce OWASP best practices during code review?▼

Yes, a formal security checklist is required to execute OWASP best practices and enforce defense-in-depth during code review. It structures the validation of output encoding, auth/authz, and parameterized queries, guiding the remediation of critical findings.

When should I block a deployment based on critical security findings?▼

Block a deployment based on critical security findings when a pre-release security audit identifies unresolved vulnerabilities in code, configurations, or infrastructure. The SECURITY.md PASS gate remains failed until defense-in-depth remediation is complete.