security-policy-review

What problem does it solve? Agentic workflows often involve privileged actions, untrusted text, secrets, dependencies, and releases that must be gated before execution. This Skill provides a structured review stage that classifies trust, detects risky side effects, and returns allow, deny, or requires-human-gate decisions with typed evidence. ## Core Features & Use Cases - Trust Classification and Gating: Classifies input trust, identifies privileged side effects, and enforces least privilege through an approved action pipeline. - Decision Matrix: Blocks exposed secrets, requires approval for medium/high-risk dependencies, denies releases without green checks, and fails closed on unclear policy. - Typed Evidence Output: Produces review.security, policy.decision, tool_firewall.review, dependency.risk, and release.risk outputs with used_evidence, assumptions, blockers, confidence, and handoff fields. - Use Case: Before an agent merges a release or installs a new dependency, run this review to verify the action pipeline, check for prompt injection from issue text, and emit a gated policy decision. ## Quick Start Review the proposed release action and dependency change for security risks and return an allow, deny, or requires-human-gate decision with typed evidence.