security-gate
Enforce minimum security criteria before iteration close or release
Best use case
security-gate is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
It is a strong fit for teams already working in Codex.
Enforce minimum security criteria before iteration close or release
Teams using security-gate should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/security-gate/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How security-gate Compares
| Feature / Agent | security-gate | Standard Approach |
|---|---|---|
| Platform Support | Codex | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Enforce minimum security criteria before iteration close or release
Which AI agents support this skill?
This skill is designed for Codex.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
Related Guides
Cursor vs Codex for AI Workflows
Compare Cursor and Codex for AI coding workflows, repository assistance, debugging, refactoring, and reusable developer skills.
AI Agents for Coding
Browse AI agent skills for coding, debugging, testing, refactoring, code review, and developer workflows across Claude, Cursor, and Codex.
AI Agents for Marketing
Discover AI agents for marketing workflows, from SEO and content production to campaign research, outreach, and analytics.
SKILL.md Source
# Security Gate (SDLC) ## Criteria - Approved threat model with mitigations or accepted risks - Zero open critical vulnerabilities; highs triaged with owners/dates - SBOM generated and reviewed (if applicable) - Secrets policy verified; no hardcoded secrets ## Output - `security-gate-report.md` with pass/fail and remediation tasks ## References - @$AIWG_ROOT/agentic/code/addons/aiwg-utils/rules/vague-discretion.md — Gate criteria must be concrete and verifiable (zero open criticals, SBOM present); never "acceptable risk" without documentation - @$AIWG_ROOT/agentic/code/addons/aiwg-utils/rules/human-authorization.md — Fail the gate and escalate to human; do not autonomously accept or close security findings - @$AIWG_ROOT/agentic/code/frameworks/sdlc-complete/rules/token-security.md — Token security policy this gate verifies (no hardcoded secrets) - @$AIWG_ROOT/agentic/code/frameworks/sdlc-complete/skills/security-audit/SKILL.md — Upstream audit skill whose findings feed into this gate's pass/fail evaluation - @$AIWG_ROOT/agentic/code/frameworks/sdlc-complete/skills/check-traceability/SKILL.md — Traceability verification that may be required as a security gate prerequisite
Related Skills
security-audit
Perform comprehensive security assessment
security-assessment
Execute STRIDE threat modeling, vulnerability scanning, and security control validation with risk scoring
gate-evaluation
Validate phase gate criteria with multi-agent review and generate pass/fail reports
forensics-investigate
Full multi-agent investigation workflow
flow-security-review-cycle
Orchestrate continuous security validation, threat modeling, vulnerability management, and security gate enforcement across SDLC phases
flow-gate-check
Orchestrate SDLC phase gate validation with multi-agent review and comprehensive reporting
complexity-gate
CI-friendly complexity enforcement gate returning pass/fail results for pipeline integration
aiwg-orchestrate
Route structured artifact work to AIWG workflows via MCP with zero parent context cost
venv-manager
Create, manage, and validate Python virtual environments. Use for project isolation and dependency management.
pytest-runner
Execute Python tests with pytest, supporting fixtures, markers, coverage, and parallel execution. Use for Python test automation.
vitest-runner
Execute JavaScript/TypeScript tests with Vitest, supporting coverage, watch mode, and parallel execution. Use for JS/TS test automation.
eslint-checker
Run ESLint for JavaScript/TypeScript code quality and style enforcement. Use for static analysis and auto-fixing.