gsd-secure-phase

What problem does it solve?

Projects often complete development phases without a verified record of implemented security mitigations, leaving gaps between planned threat models and actual outcomes; this Skill audits past phases and produces or updates authoritative mitigation documentation. It helps reduce overlooked vulnerabilities, ensure accountability, and provide concrete guidance for unresolved risks.

Core Features & Use Cases

• Audit existing SECURITY.md: Analyze an existing SECURITY.md for completeness and verify that documented mitigations were actually implemented.
• Reconstruct from artifacts: When SECURITY.md is missing but PLAN.md and threat model artifacts exist, extract threat-model items and derive mitigations from available artifacts and logs.
• Phase gating and guidance: Detect if a phase was never executed and provide next-step guidance rather than producing false documentation.
• Use Case: After finishing sprint phase 4, run the Skill to reconcile the phase's implemented fixes with the threat model and produce an updated SECURITY.md for release.

Quick Start

Run the gsd-secure-phase skill for the completed phase number to audit artifacts and update SECURITY.md with verified mitigations.