skills.rest
asengardeon
asengardeonCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sdd-security

Runs the security review stage of the SDD pipeline via the security-engineer agent.

Updated Aug 25, 2026
Search Tags:#authentication#owasp#claude code#security review#code audit#sdd pipeline#dependency vulnerabilities
One-click install
npx skills add https://github.com/asengardeon/btt-sdd-pipeline --skill sdd-security-asengardeon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sdd-security
Source: https://github.com/asengardeon/btt-sdd-pipeline/tree/main/.claude/skills/sdd-security
Command: npx skills add https://github.com/asengardeon/btt-sdd-pipeline --skill sdd-security-asengardeon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It enforces a mandatory security review step in a spec-driven development pipeline, ensuring every feature is audited for OWASP risks, secrets, authentication/authorization flaws, input validation, and dependency vulnerabilities before release. ## Core Features & Use Cases - Pipeline Gate Enforcement: Verifies the QA report exists with an approved verdict before invoking the security-engineer agent, preventing skipped stages. - Branch Hygiene: Rebases stale feature branches onto main and handles retroactive reviews of already-merged PRs via a dedicated branch and PR. - Audit Trail: Logs invocation timing to specs/<slug>/timing-log.md and produces specs/<slug>/security-review.md from a template. - Use Case: After QA approves a feature, run this stage to have the security-engineer agent review the TRD, QA report, and PR, then route failures back to implementation or pass approved work to the SRE stage. ## Quick Start Run the security review stage for the current feature after QA approval to generate its security-review report.

Frequently Asked Questions about sdd-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review in a spec-driven development pipeline?▼

Invoke the security stage after QA approval; it calls the security-engineer agent with the TRD, QA report, and feature PR to produce specs/<slug>/security-review.md from a template. The verdict determines whether work proceeds to SRE or returns to implementation.

What does the security-engineer agent check during review?▼

It reviews the application across OWASP categories, exposed secrets, authentication and authorization logic, input validation, and dependency vulnerabilities. Findings are grouped by area in the security-review report with an overall verdict.

Can I run the security review if the feature branch was already merged?▼

Yes. For retroactive reviews of merged PRs, create a new branch from origin/main, produce only the security-review.md for that round, and open its own PR without additional gates since no new code is being reviewed.

What happens when a security review fails?▼

The feature returns to the implementation stage with the listed findings. Prefer resuming the same agent that implemented the slice via SendMessage for small, targeted fixes rather than invoking a new agent.

Why must the branch be synced with main before security review?▼

Reviewing a stale branch causes blind commits that conflict later, often discovered only at the final SRE stage. The skill fetches origin/main, counts new commits, and rebases the feature branch before reviewing.

Related Skills

Explore More Software Engineering Skills→
igot-aiigot-ai

security-review

Detect secrets, injection, auth, and dependency risks in code changes.

Official
Intermediate
acardozzoacardozzo

ops-rx

Evaluate operational and SRE maturity across 8 dimensions and 32 sub-metrics.

Community
Advanced
dr-codedr-code

release-check

Run pre-release verification checks and write a versioned release assessment report.

Community
Advanced
NoobyGainsNoobyGains
78

quality-enforcement

Enforce code quality standards across pre-commit, pre-merge, and CI pipeline stages.

Community
Advanced