security

To automate security and privacy reviews for project assets, you can use this Skill to run static analysis and dependency checks during pre-release workflows. It validates your artifacts and only stores outputs to final/ after all checks pass successfully.

The designated scanners used for static analysis and dependency checks include bandit, safety, npm audit, trivy, and snyk. These tools validate project assets to identify vulnerabilities before allowing any writes to the final/ directory.

RBAC enforcement restricts write access to the final/ directory, ensuring only designated users can save validated outputs. This workflow integrates with /setup-from-application to auto-update rules and RBAC policies during artifact validation.

Yes, this is specifically designed for pre-release workflows, code reviews, and artifact validation. It enforces RBAC, applies designated scanners, and generates audit-ready reporting while restricting writes to final/ only after successful validation.

Restricting writes to final/ after security checks means unvalidated outputs cannot be stored in that directory. This ensures audit-ready reporting and privacy compliance, but requires all static analysis and dependency checks to pass successfully first.