gsd-secure-phase

To verify threat mitigations retroactively, this Skill audits a completed phase by validating existing SECURITY.md or PLAN.md artifacts, confirming that implemented mitigations align with the threat model and effectively reduce risk.

When SECURITY.md is missing, phase audit works by running artifact-driven execution from PLAN.md, leveraging the existing threat model documentation to drive verification and output concrete remediation recommendations.

No, you cannot audit threat mitigations if the phase was not executed. The Skill specifically verifies completed phases and will exit with guidance if the phase execution has not occurred.

The best way to document validated security mitigations is through an automated audit that updates SECURITY.md with the final validated findings, ensuring implemented protections align with compliance requirements and threat models.

You need either a SECURITY.md or a PLAN.md containing a threat model to run a phase audit. If both are missing, the Skill cannot verify mitigations and will exit with remediation guidance.