Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed coding workflow aid that asks the agent to plan, branch, test, and review before presenting work.
Install this if you want a stricter coding workflow. Be aware it may slow work down by requiring plan confirmation, branches, tests, and reviews, and only add the CLAUDE.md text if you want that behavior to persist for the project.
The example trigger phrases include broad, natural-language prompts such as asking the agent to 'plan before coding' or 'review your work before showing me'. In systems that auto-activate skills from conversational matches, these phrases can cause unintended skill activation during ordinary development discussions, altering agent behavior without the user's explicit intent.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- [ ] Do not proceed to Stage 2 without explicit user confirmation of the plan — coding before confirmation defeats the entire purpose of the planning stage
- [ ] Do not write tests after the implementation and call it "test-first" — tests must be written and confirmed failing before the implementation starts
- [ ] Do not skip the Double Review when time is tight — the review is most valuable precisely when speed is the priority, because that is when errors are most likely
- [ ] Do not expand scope during Stage 2 without surfacing it — silent scope expansion produces code the user did not approve and may not want
- [ ] Do not mark both reviews as clean without actually performing them — a rubber-stamp review produces false confidence and defeats the framework
## Example Trigger Phrases