All skills
security-privacy-gate
ProfessionalRuntime top levelanalysis-agent: analyze permissions, secrets, sensitive data, trust boundaries and injection; task-agent: implement controls; review-agent: assess evidence. Skip self-review or no security/privacy lifecycle impact.
- Group
- Quality, security, reliability and delivery gates
- Routing mode
- evidence-only
- Supported roles
- MainAnalysisTaskReview
- Source
- SKILL.md
Use when
Trigger signals that make this skill the right owner
- proved trust, privilege, permission, credential, or secret boundary change with a reachable abuse or disclosure path
- credential or session lifecycle behavior change
- evidenced personal-data purpose, processing, retention, deletion, or other lifecycle change with a concrete privacy consequence
Do not use when
Anti-triggers — as binding as the triggers above
- no security boundary or privacy lifecycle impact
- self review request
- internal refactor with evidence that security controls and credential, session, and privacy lifecycle behavior are unchanged
- reliability-only failure with no abuse or privacy risk
- input shape change with no security sink or privacy lifecycle consequence
- scanner report organization without a security verdict
- security terminology, a permission API, path mutability, or future replacement possibility without a proved trust, privilege, secret, or privacy boundary change
- bounded same-principal non-sensitive local access with no privilege elevation or less-trusted writer
Required inputs
What must be supplied before this skill can decide anything
- acceptance
- security boundary or privacy lifecycle summary
Output contract
What this skill owes the next role
- security-path or privacy-lifecycle model
- control changes
- security/privacy verdict
Escalation signals
When this skill must hand the decision back
- scope, authority, or material risk exceeds the selected task contract
Related expertise
17 Layer 3 candidates may be loaded behind this skill — each only when the current task's evidence calls for it, never as a bundle.
- threat-modeling
- permission-boundary-modeling
- authentication-authorization
- input-validation
- web-security
- secret-configuration-security
- idempotency-retry-design
- regression-testing
- payment-trading-extension
- ai-product-extension
- authentication-security
- dependency-vulnerability-scanning
- privacy-data-lifecycle
- cloud-platform-extension
- tenant-isolation
- cryptography-key-lifecycle
- audit-evidence-integrity
Targeted references
Each reference carries its own load condition. None of them enter context by default.
| Reference | Load when | Do not load when | Required by |
|---|---|---|---|
| checklist.mddecision-checklist | A bounded mode needs compact checks for its triggered authorization, input/output, secret, dependency, privacy, cloud, AI, or tool risk | The root gate is enough or mode-specific closure and targeted proof are required | AnalysisTaskReview |
| evidence-patterns.mdevidence-pattern | Closure depends on command/report artifacts, exit code, denied-case proof, scanner evidence, sandbox classification, freshness, or proof limits | No selected security or privacy claim depends on runtime evidence or the root contract is sufficient | AnalysisTaskReview |
| index.mdindex | competing security privacy gate references require dependency, conflict, or output-fragment selection | the security privacy gate root or a task-named reference already resolves selection | AnalysisTaskReview |
| security-output-and-gates.mdtargeted | work needs mode-specific closure and targeted gates for a selected authorization, abuse, secret, dependency, privacy, cloud, AI, or tool-authority risk | A compact result is sufficient and no selected risk needs the extended proof contract | AnalysisTaskReview |