meta-security-review-bundle

Name: meta-security-review-bundle
Availability: InStock
Author: opensquilla

Arbitrates policy review, secret scanning, and audit logging verdicts for proposed operations.

6.8k|540|Updated May 6, 2026

Search Tags:#meta-skill #security review #arbitration #secret scanning #audit log #credential detection #Policy enforcement

Ready to run

npx skills add https://github.com/opensquilla/opensquilla --skill meta-security-review-bundle

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: meta-security-review-bundle
Source: https://github.com/opensquilla/opensquilla/tree/main/src/opensquilla/skills/exp/meta-security-review-bundle
Command: npx skills add https://github.com/opensquilla/opensquilla --skill meta-security-review-bundle

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reviewing a proposed code change, script, or environment manipulation for safety requires multiple independent checks, and relying on a single judgment call can miss policy violations or leaked credentials.

Core Features & Use Cases

Parallel Security Gates: Runs a policy/governance review and a secret/credential scan independently over the candidate operation.
Strict Arbitration Rule: Resolves verdicts with an explicit priority (governance DENY > scanner WARN > ALLOW) encoded in the prompt, not left to model discretion.
Audit Trail: Appends every review — operation, gate outputs, and final verdict — to memory/security-review.md for later recall.
Use Case: Before executing a user-requested shell script that touches system paths, run this bundle to deny modifications to /etc/ or credential exfiltration, warn on embedded API keys, and log the outcome.

Quick Start

Review this proposed operation for safety before running it: the script reads ~/.aws/credentials and uploads them to a remote server.

Frequently Asked Questions about meta-security-review-bundle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I review a proposed code change for safety before running it?▼

Run the security review bundle over the candidate operation. It applies a policy gate that denies modifications to system paths like /etc/ or credential exfiltration, plus a secret scanner that flags API keys, tokens, and private keys, then arbitrates a final DENY, WARN, or ALLOW verdict.

How does the arbitration rule decide between DENY, WARN, and ALLOW?▼

The rule applies strict priority: a policy_review DENY always wins and its reason passes through verbatim; otherwise a secret_scan WARN requires explicit user acknowledgement; only when policy allows and the scan is clear does it return ALLOW.

What kinds of secrets does the credential scan detect?▼

The scanner detects API keys (sk-, ghp_, AKIA, AIza patterns), JWT and OAuth bearer tokens, PEM private keys, database connection URIs with embedded passwords, and plaintext passwords next to labels like pwd= or password:.

What happens if one of the security gates fails or times out?▼

If a gate errors, times out, or returns an empty deliverable, the orchestrator's failure cascade produces a structured failure payload. Operators review the partial verdicts in step_outputs and decide manually rather than getting an automatic verdict.

When should I not use a multi-gate security review bundle?▼

Avoid it when only one rule set genuinely applies, because the combinator pattern multiplies token cost by the number of gates for a single turn. Prefer a single well-defined orchestrator sequence for routine reviews.