What problem does it solve?
Projects often complete development phases without a verified record of implemented security mitigations, leaving gaps between planned threat models and actual outcomes; this Skill audits past phases and produces or updates authoritative mitigation documentation. It helps reduce overlooked vulnerabilities, ensure accountability, and provide concrete guidance for unresolved risks.
Core Features & Use Cases
- Audit existing SECURITY.md: Analyze an existing SECURITY.md for completeness and verify that documented mitigations were actually implemented.
- Reconstruct from artifacts: When SECURITY.md is missing but PLAN.md and threat model artifacts exist, extract threat-model items and derive mitigations from available artifacts and logs.
- Phase gating and guidance: Detect if a phase was never executed and provide next-step guidance rather than producing false documentation.
- Use Case: After finishing sprint phase 4, run the Skill to reconcile the phase's implemented fixes with the threat model and produce an updated SECURITY.md for release.
Quick Start
Run the gsd-secure-phase skill for the completed phase number to audit artifacts and update SECURITY.md with verified mitigations.