skills.rest
TruCol270
TruCol270COMMUNITY
Explore all skills by this author →
GitHub

gsd-secure-phase

Audit SECURITY.md and PLAN.md artifacts to validate threat mitigations.

1|Updated Apr 7, 2026
Search Tags:#compliance#workflows#security-audit#security-policy#threat-mitigation#phase-verification
One-click install
npx skills add https://github.com/TruCol270/salty-pickle --skill gsd-secure-phase-trucol270
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gsd-secure-phase
Source: https://github.com/TruCol270/salty-pickle/tree/main/.claude-skills/gsd-secure-phase
Command: npx skills add https://github.com/TruCol270/salty-pickle --skill gsd-secure-phase-trucol270

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audits and verifies threat mitigations for a completed phase by checking for security documentation (SECURITY.md), validating the presence and quality of threat models in PLAN.md artifacts, and providing guided updates when a phase has not been executed.

Core Features & Use Cases

  • Audit existing SECURITY.md to confirm mitigations are documented and active.
  • Validate PLAN.md threat models and related artifacts to support retroactive threat mitigation verification.
  • Provide clear guidance and updated SECURITY.md if a phase was not executed, preserving workflow integrity.

Quick Start

Run the secure-phase workflow to verify and update threat mitigations for the latest completed phase.

Frequently Asked Questions about gsd-secure-phase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit threat mitigations for a completed project phase?▼

To audit threat mitigations for a completed phase, run the secure-phase workflow to validate existing SECURITY.md documentation and verify threat models in PLAN.md artifacts, outputting an updated SECURITY.md.

What happens if a security audit is run when no phase has executed?▼

When no phase has run, the secure-phase workflow provides clear guidance and generates an updated SECURITY.md to establish baseline threat mitigations while preserving workflow gates.

How do I verify that documented threat mitigations are actually active?▼

To verify threat mitigations are active, audit the existing SECURITY.md documentation post-run. The secure-phase workflow confirms whether documented mitigations are present and active for the completed phase.

Does the secure-phase workflow preserve workflow gates during a security audit?▼

Yes, the secure-phase workflow preserves workflow gates while executing. It audits documentation and validates threat models without disrupting the established phase progression controls.

What is the best way to update SECURITY.md after completing a development phase?▼

The best way to update SECURITY.md post-phase is running the secure-phase workflow, which audits existing documentation and validates threat models to output an updated security policy file.

Why does my security audit fail when only PLAN.md exists without SECURITY.md?▼

The audit does not fail; when only PLAN.md exists, the secure-phase workflow validates the threat model artifacts present in PLAN.md to support retroactive threat mitigation verification and generate the required security documentation.

Related Skills

Explore More Legal & Compliance Skills→
aslaiiaslaii

gsd-secure-phase

Audit security artifacts and generate an updated SECURITY.md with verified mitigations.

Community
Intermediate
yusaduymazyusaduymaz

gsd-secure-phase

Verify implemented threat mitigations in completed GSD phase artifacts.

Community
Advanced
tech-leads-clubtech-leads-club
5.0k

security-threat-model

Generate a repo-grounded AppSec threat model with assets, trust boundaries, and mitigations.

Official
Advanced
nnexainnexai
1

gsd-secure-phase

Audit security documentation and threat models to verify mitigations for completed project phases.

Community
Advanced