# Review Security Before Release

Teams miss security issues when release checks are informal. This skill guides Claude, Codex, and Claude Code through structured security questions and warning templates.

## Install

```bash
npx skillstore add danielpodolsky/security-gate
```

## Metadata

- Status: approved
- Slug: danielpodolsky-security-gate
- Skillstore revision: r1
- Version status: missing
- Tree hash: 6452446dac4d5933bf4e436769c31c16f44fd1fb6fa097f95de2d3755b4fa1a9
- Author: DanielPodolsky
- GitHub username: DanielPodolsky
- License: MIT
- Repository: https://github.com/DanielPodolsky/mentor-spec/tree/main/.claude/skills/gates/security
- Ref: 34f316ba14ef36c7a620fc09f2676d2429997a77
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: scripts, external\_commands, env\_access
- Quality score: 79
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/danielpodolsky-security-gate
- Manifest: https://skillstore.pages.dev/api/skills/danielpodolsky-security-gate/manifest

## Capabilities

- Asks focused questions about user input, data access, secrets, and authorization.
- Provides a checklist for input handling, authentication, data exposure, and common vulnerabilities.
- Formats results as pass, warning, or critical warning messages.
- Includes examples for SQL injection, XSS, IDOR, and hardcoded secrets.
- Uses Socratic questions to help teams reason about attack scenarios.

## Use Cases

- Pre-Release Feature Review: Check a new feature for input validation, authorization, and data exposure risks before launch.
- Security Coaching Session: Use structured questions to help a developer understand security risks in their implementation.
- Pull Request Risk Triage: Summarize security concerns from a change and decide which issues need attention before merge.

## Prompt Templates

### Run a Basic Security Gate

```
Run the security gate for this feature. Focus on user input, data access, secrets, and obvious release risks.
```

### Review a Pull Request

```
Apply the security gate to this pull request. List pass items, warnings, critical warnings, and questions for the author.
```

### Assess Sensitive Data Handling

```
Use the security gate to review how this change handles sensitive data, tokens, logs, errors, and authorization checks.
```

### Prepare a Release Decision

```
Run the full security gate and produce a release recommendation. Separate must-fix issues, recommended fixes, residual risks, and owner questions.
```

## Limitations

- It is advisory guidance and does not scan code automatically.
- It depends on accurate code context from the user or agent.
- It does not replace a professional security review for high-risk systems.
- It does not run tests, dependency scans, or dynamic application checks.

## Best Practices

- Provide the relevant code paths, data flows, and user roles before running the gate.
- Treat critical warnings as release blockers until a responsible owner accepts the risk.
- Document each warning with a location, impact, and follow-up decision.

## Anti Patterns

- Using the gate as a substitute for automated security testing.
- Reviewing only happy paths and skipping malicious input cases.
- Closing warnings without recording the reason or owner.

## Security Audit

- Audited at: 2026-07-06T09:48:10.841\+00:00
- Summary: All static findings are false positives caused by Markdown security checklist text and illustrative vulnerability examples. The skill contains no executable scripts, external command execution, environment access, or prompt injection attempts.

## Stats

- Views: 256
- Downloads: 9
- Favorites: 0
- Popularity score: 0