planning-security-scopelisted

Use when a delivery run's freshly produced planning scope needs its functional security surface reviewed: which actors and actions are security-sensitive, what the abuse cases are, and what access assumptions the requirements silently make. This is the planning_security_scope action of the planning stretch — one Agent-tool dispatch with subagent_type security-reviewer — a requirements-level security read, distinct from security-architecture-review (design-level) and security-review (implementation-level).
BhangeeF16/kaizen · ★ 0 · AI & Automation · score 65

Install: claude install-skill BhangeeF16/kaizen

# Planning Security Scope Review the planning output for its functional security scope. This is a requirements-level pass: it names what is sensitive and how it could be abused, before any design exists to review. ## Dispatch One synchronous `Agent`-tool call, `subagent_type: security-reviewer`. The persona file carries the domain lens; this skill defines the action's own contract. ## Required inputs - `planning.md` for the target. ## Required outputs (all mandatory) - Security-sensitive actors and actions, named explicitly. - Abuse cases for the sensitive workflows. - Access assumptions the requirements make (tenant scope, resource scope, role expectations), stated so later stages can validate them instead of rediscovering them. ## Result Report each required output produced (with its location), the result (pass / pass_with_risks / blocked / failure), and blocking questions as an explicit list (empty list stated explicitly).