gsd-secure-phase

Audit completed phase artifacts and update SECURITY.md with verified threat mitigations.

Updated Jan 25, 2026
One-click install
npx skills add https://github.com/MINT-IA/MINT --skill gsd-secure-phase
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: gsd-secure-phase
Source: https://github.com/MINT-IA/MINT/tree/main/.claude/skills/gsd-secure-phase
Command: npx skills add https://github.com/MINT-IA/MINT --skill gsd-secure-phase

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Projects often complete development phases without a verified record of implemented security mitigations, leaving gaps between planned threat models and actual outcomes; this Skill audits past phases and produces or updates authoritative mitigation documentation. It helps reduce overlooked vulnerabilities, ensure accountability, and provide concrete guidance for unresolved risks.

Core Features & Use Cases

  • Audit existing SECURITY.md: Analyze an existing SECURITY.md for completeness and verify that documented mitigations were actually implemented.
  • Reconstruct from artifacts: When SECURITY.md is missing but PLAN.md and threat model artifacts exist, extract threat-model items and derive mitigations from available artifacts and logs.
  • Phase gating and guidance: Detect if a phase was never executed and provide next-step guidance rather than producing false documentation.
  • Use Case: After finishing sprint phase 4, run the Skill to reconcile the phase's implemented fixes with the threat model and produce an updated SECURITY.md for release.

Quick Start

Run the gsd-secure-phase skill for the completed phase number to audit artifacts and update SECURITY.md with verified mitigations.

Frequently Asked Questions about gsd-secure-phase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify security mitigations after a project phase is completed?

To verify security mitigations for a completed phase, audit implemented artifacts against threat-model items from your PLAN.md. This process reconciles actual development outcomes with planned security controls and produces an updated SECURITY.md record.

Can I reconstruct a SECURITY.md if it is missing but a threat model exists?

Yes, you can reconstruct a SECURITY.md by extracting threat-model items from PLAN.md and deriving mitigations from available project artifacts and logs. This ensures documented security controls reflect actual implemented fixes.

What do I need to audit a completed phase for security threats and mitigation verification?

You need a completed project phase and either an existing SECURITY.md or a PLAN.md containing a threat model and related artifacts. The audit compares these planned items against implemented artifacts to update mitigation documentation.

What happens if I try to audit security for a phase that was never executed?

If a phase was never executed, the audit detects the missing execution and provides next-step guidance rather than producing false documentation. This prevents inaccurate SECURITY.md entries and preserves workflow gate integrity.

When should I run a security retrospective on my development phases?

Run a security retrospective when a development phase is finished and you need to reconcile implemented fixes with the threat model. This ensures accountability, reduces overlooked vulnerabilities, and provides concrete guidance for unresolved risks.