skills.rest
jedmamosto
jedmamostoCOMMUNITY
Explore all skills by this author →
GitHub

gsd-secure-phase

Verify phase threat mitigations and update SECURITY.md from PLAN.md artifacts.

Updated May 21, 2026
Search Tags:#security audit#documentation update#phase review#threat model#risk controls#mitigation verification
One-click install
npx skills add https://github.com/jedmamosto/m-and-ms --skill gsd-secure-phase-jedmamosto
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gsd-secure-phase
Source: https://github.com/jedmamosto/m-and-ms/tree/main/.agents/skills/gsd-secure-phase
Command: npx skills add https://github.com/jedmamosto/m-and-ms --skill gsd-secure-phase-jedmamosto

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you verify that security threat mitigations were properly implemented for a completed project phase, ensuring the right controls exist and are documented.

Core Features & Use Cases

  • Mitigation verification flow: Confirms whether SECURITY.md exists, then audits it against the phase’s execution evidence.
  • Artifact-based recovery: If SECURITY.md is missing but PLAN.md includes a threat model, runs verification using stored artifacts from the phase.
  • Execution-state guardrails: Detects when the phase was not executed and exits with guidance instead of producing a misleading report.

Quick Start

Run the Skill with the phase number you want to verify, and it will update SECURITY.md accordingly.

Frequently Asked Questions about gsd-secure-phase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify threat mitigations for a completed project phase?▼

Threat mitigation verification audits a completed phase against execution evidence to confirm security controls are implemented. It reads existing SECURITY.md or derives verification from PLAN.md and phase artifacts, then writes an updated SECURITY.md while preserving workflow gates.

What happens if SECURITY.md is missing during a phase security review?▼

Security review recovery uses artifact-based verification when SECURITY.md is missing. It checks if PLAN.md includes a threat model, then runs verification using stored phase artifacts to generate and write the missing SECURITY.md documentation.

How do I document risk controls for a staged project phase?▼

Documenting risk controls requires auditing phase execution evidence against the threat model. The Skill reads phase artifacts and PLAN.md, verifies mitigation implementation, and outputs an updated SECURITY.md file containing the verified controls.

Can I run a security audit on a project phase that was never executed?▼

Security audits on unexecuted phases are blocked by execution-state guardrails. The Skill detects when a phase was not executed and exits with guidance instead of producing a misleading mitigation verification report.

When do I need to update SECURITY.md for a phase review?▼

SECURITY.md updates are needed when verifying that threat mitigations are properly documented and implemented for a completed phase. The Skill audits it against the phase's execution evidence and updates the file while preserving workflow gates.

Related Skills

Explore More Legal & Compliance Skills→
tech-leads-clubtech-leads-club
5.0k

security-threat-model

Generate a repo-grounded AppSec threat model with assets, trust boundaries, and mitigations.

Official
Advanced
Poom5741Poom5741

gsd-secure-phase

Audit completed phases against SECURITY.md and update verified threat mitigations.

Community
Advanced
dandudzidandudzi
2

stride-analysis-patterns

Enumerate STRIDE threats, construct DFDs, score risks with DREAD, and map mitigations.

Community
Advanced
gesmith0606gesmith0606

gsd-secure-phase

Audit threat mitigations for completed phases and update SECURITY.md.

Community
Advanced