skills.rest
oleyna80
oleyna80COMMUNITY
Explore all skills by this author →
GitHub

security-verification-gate

Verifies security patches through diff review, validation commands, and ship/no-ship verdicts.

Updated Jun 12, 2026
Search Tags:#code review#owasp#diff review#secret scanning#release gate#security verification#ship verdict
One-click install
npx skills add https://github.com/oleyna80/agentic-sdlc-framework --skill security-verification-gate-oleyna80
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-verification-gate
Source: https://github.com/oleyna80/agentic-sdlc-framework/tree/main/skills/security-verification-gate
Command: npx skills add https://github.com/oleyna80/agentic-sdlc-framework --skill security-verification-gate-oleyna80

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? After a security fix is implemented, teams need an independent check that the patch actually resolves the findings without introducing regressions or leaking secrets before release. This Skill performs that post-implementation verification and produces a clear ship/no-ship verdict. ## Core Features & Use Cases - Independent diff review: Compares the actual diff against the declared scope and runs validation commands including npm audit and secret scanning. - OWASP-mapped checklist: Reviews SQL injection, XSS sinks, CSRF guards, redirect allowlisting, weak randomness, and security headers, mapping findings to OWASP 2021 categories. - Structured verdict output: Produces a findings closure matrix, runtime proof matrix status, open blockers, and a ship verdict of safe incremental ship or needs changes. - Use Case: After a coder fixes an XSS vulnerability and a CSRF gap, run this Skill to confirm the fixes, scan the staged diff for secrets, and receive a release-readiness verdict with residual risk documented. ## Quick Start Ask the agent to run the security verifier on the latest fixes and produce a ship verdict with the findings closure matrix.

Frequently Asked Questions about security-verification-gate

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify a security patch before release?▼

Run an independent verification pass that reviews the actual diff against the declared scope, executes validation commands like npm audit and secret scans, and checks an OWASP-mapped security checklist. The result is a ship or no-ship verdict with documented residual risk.

What does a security verification checklist cover?▼

The checklist covers SQL parameterization, XSS sinks and sanitization, CSRF and origin guards on mutation endpoints, redirect and path allowlisting, weak randomness, dynamic code execution, sanitized errors, and security headers. Findings map to OWASP 2021 categories A01 through A10.

Can the verifier fix issues it finds during review?▼

No. The verifier operates in a read-only mode and cannot expand implementation scope. Any follow-up fix must be handled as a separate coder step, and the verifier only reports findings and verdicts.

What happens when runtime proof cannot be completed?▼

When DNS, deployment state, or live-action approval blocks runtime proof, the check is reported as blocked with the specific blocker identified. It is carried as a separate follow-up gate rather than being marked as passed.

How are security findings triaged after verification?▼

Each original finding is mapped to a unified status model: confirmed, partially confirmed, stale/resolved, rejected, or needs-more-proof. This closure matrix is handed off for SSOT synchronization along with the final verdict.

Related Skills

Explore More Software Engineering Skills→
JamesFincherJamesFincher

requesting-code-review

Scan staged git diffs, run baseline tests, and delegate JSON-only review.

Community
Advanced
hujianbesthujianbest
1

hf-finalize

Close out tasks and workflow cycles with state sync and evidence.

Community
Advanced
ShmurdocShmurdoc

cso

Automate infrastructure-first security audits for secrets, dependencies, CI/CD, and LLM/AI systems.

Community
Advanced
mlvpatelmlvpatel
1

apex-pipeline

Orchestrate seven-phase application security testing from intake to report.

Community
Advanced