Menu
Use when adding security, privacy, or compliance constraints to technical artifacts. Before or after technical planning.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when producing product artifacts - epics, user stories, acceptance criteria, or analytics specs.
Use when defining product direction, vision document sections, or roadmap. Triggers on strategic product planning, vision creation, or vision document quality review.
Use when designing UI, choosing colors, typography, spacing, creating visual hierarchy, or making design decisions. Based on Refactoring UI by Wathan & Schoger.
Use when someone needs a plain-language explanation of how an existing feature or edge case behaves in the codebase. Triggers - non-technical stakeholder asks how something works, need code-informed functional explanation, need to understand rules or edge cases without implementation planning.
Use when a developer wants to go from rough idea to working code autonomously. Triggers - imperfect prompt, solo dev wants full pipeline, "just build it", idea to implementation without manual steps.
Use when creating a new agentic workflow skill. Triggers - need new multi-step orchestrated process, want to add workflow to agentic framework, building spec-driven pipeline.
| name | security-context |
| description | Use when adding security, privacy, or compliance constraints to technical artifacts. Before or after technical planning. |
Harden engineering work by adding security constraints to story artifacts.
{ide-folder}/{outputFolder}/product/prd/.../US-*.md){ide-folder}/{outputFolder}/task/{epicNumber}-EPIC-{epicName}/US-{usName}-{usNumber}/security-addendum.md
technical-context.md exists: focus on constraints, threat model, missing infotechnical-plan.md exists: propose concrete security constraints (no code)Epic ID: EPIC-{epicNumber}
User Story ID: US-{usNumber}
Document: Security Addendum
Status: Draft | Ready
Owner: Security Engineer (Addendum)
Last Updated: (ISO timestamp)
Inputs: (list exact paths)
| # | Section | Content |
|---|---|---|
| 1 | Security objectives | What must be protected and why (1-5 bullets) |
| 2 | Mini threat model | Assets, actors, trust boundaries, abuse cases (top 3) |
| 3 | Multi-tenancy isolation | MANDATORY - tenant boundary, "must never happen" list |
| 4 | Security requirements | SEC-REQ-01... - specific, testable. Cover: AuthN/Z, input validation, CSRF, rate limiting, logging, secrets, error handling |
| 5 | OWASP Top 10 mapping | Only relevant items, not generic checkbox |
| 6 | Privacy / GDPR constraints | Data minimization, retention, access/export, logging |
| 7 | Security Verification Matrix | MANDATORY - SEC-REQ-* → tests/checks |
| 8 | Required changes to Technical Plan | Explicit additions/edits with SEC-REQ-* / AC-* refs |
| 9 | Open questions / assumptions | Only blockers, propose safe defaults |
/sync-issue after writing