skills.rest
asengardeon
asengardeonCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security

Runs stage 5 security review of a feature via the security-engineer agent, producing security-review.md.

Updated Aug 25, 2026
Search Tags:#authentication#git workflow#owasp#agent orchestration#security review#code audit#sdd pipeline
One-click install
npx skills add https://github.com/asengardeon/btt-sdd-pipeline --skill security-asengardeon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/asengardeon/btt-sdd-pipeline/tree/main/plugins/btt-sdd/skills/security
Command: npx skills add https://github.com/asengardeon/btt-sdd-pipeline --skill security-asengardeon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? After QA approves a feature in the SDD pipeline, the application still needs a dedicated security review before SRE sign-off. This Skill orchestrates that review step so it is never skipped, covering OWASP risks, secrets, authentication/authorization, input validation, and dependencies. ## Core Features & Use Cases - Pipeline Gate Enforcement: Verifies that an approved qa-report.md exists before starting, and blocks skipping QA. - Agent Orchestration: Invokes the security-engineer agent with worktree isolation, passing the TRD, QA report, and feature PR to produce specs/<slug>/security-review.md. - Git Hygiene: Handles retroactive reviews of already-merged PRs, rebases stale branches onto main, and logs invocation timing to timing-log.md. - Use Case: A feature passed QA and you need a formal security review artifact before release — run this stage to get a verdict per area (OWASP, secrets, auth, input validation, dependencies) and route failures back to implementation. ## Quick Start Run the security review stage for the current feature slug after its QA report has been approved.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review in the SDD pipeline?▼

Run the security stage after QA approves the feature. It verifies an approved qa-report.md exists, then invokes the security-engineer agent with the TRD, QA report, and feature PR to produce specs/<slug>/security-review.md.

What does the security-engineer agent review?▼

The agent reviews the application across OWASP risks, exposed secrets, authentication and authorization, input validation, and dependency vulnerabilities. Findings are reported per area with an overall verdict in security-review.md.

Can I do a security review after the PR was already merged?▼

Yes. For retroactive reviews, create a new branch from origin/main, produce only the security-review.md for that round, and open its own PR without additional gates, since no new code is being reviewed.

What happens if the security review fails?▼

The feature returns to the implementation stage with the listed findings. Prefer resuming the same agent that implemented the slice via SendMessage for small, targeted fixes rather than invoking a new agent.

Why must the branch be synced with main before the security review?▼

If main has new commits since the branch was created, the branch must be rebased onto origin/main first. This prevents the security and SRE stages from committing onto a conflicting base discovered only at the final stage.

Related Skills

Explore More Software Engineering Skills→
nickmaglowschnickmaglowsch
31

qa

Automate browser-based QA exploration and generate Playwright tests and QA reports.

Community
Advanced
qprjack86qprjack86

azure-validate

Validate Azure deployment readiness across AZD, Bicep, Azure CLI, and Terraform workflows.

Community
Advanced
J-StaR-Films-StudiosJ-StaR-Films-Studios
23

security-audit

Audit codebases for security vulnerabilities, logical errors, and quality issues.

Official
Advanced
skyoxuskyoxu

bmad-agent-game-architect

Route BMAD user requests to the canonical gds-agent-game-architect skill.

Community
Basic