gsd-secure-phase

Verify threat mitigations from SECURITY.md and PLAN.md artifacts.

4|Updated Apr 11, 2026

Search Tags:#security #mitigation #workflow audit #threat model #phase verification

Ready to run

npx skills add https://github.com/electroheadfx/efx-mux --skill gsd-secure-phase-electroheadfx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gsd-secure-phase
Source: https://github.com/electroheadfx/efx-mux/tree/main/.codex/skills/gsd-secure-phase
Command: npx skills add https://github.com/electroheadfx/efx-mux --skill gsd-secure-phase-electroheadfx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you retroactively verify that a completed phase still has the required threat mitigations in place, so security gaps are caught before the work is treated as done.

Core Features & Use Cases

Security audit from phase artifacts: Reviews the completed phase using SECURITY.md, PLAN.md, and related workflow artifacts when available.
Mitigation verification: Confirms that the documented threat model and mitigation steps were actually addressed.
Completion guidance: If the phase was never executed, it stops and provides clear next-step guidance instead of pretending verification is possible.
Use Case: A team finishes a feature phase and wants an AI to check whether every planned security mitigation was verified and recorded.

Quick Start

Use the gsd-secure-phase skill to verify the mitigations for the last completed phase and update SECURITY.md with the results.

Frequently Asked Questions about gsd-secure-phase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify threat mitigations before releasing a completed development phase?▼

Security phase verification retroactively audits completed development work against documented threat models and planning artifacts. It confirms that planned security steps were actually addressed before treating the phase as done, preventing security gaps from reaching production.

How do I audit completed development work against a threat model using SECURITY.md?▼

You audit completed work by reconciling SECURITY.md and PLAN.md artifacts against the finished development phase. This workflow checks whether documented threat mitigations were actually implemented and produces an updated SECURITY.md recording the validation status.

Do I need a threat model and completed work to run a security phase verification?▼

Yes, security phase verification requires a completed development phase, a documented threat model, and SECURITY.md or PLAN.md evidence. If the phase was never executed, the process stops and provides next-step guidance instead of attempting to validate incomplete work.

What is the best way to check if planned security mitigations were actually addressed?▼

The best way to check if planned security mitigations were addressed is to perform a post-phase validation that reconciles your threat model with completed work. This retroactively confirms implementation and records the verification results in your SECURITY.md file.

What happens if I try to verify threat mitigations for a phase that was never executed?▼

If you try to verify threat mitigations for an unexecuted phase, the process stops. It recognizes that validation is impossible without completed work and provides clear next-step guidance rather than pretending the verification succeeded.