Menu
Phoenix auth/session/CSRF, command authorization, event data sensitivity, Postgres, dependency, secret, and threat-model review triggers.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Fine-grained outside-in RED-GREEN-REFACTOR microcycles with specialist agents and single-diagnostic implementation.
RGR sequence, observed-failure evidence, drill-down unit tests, and non-behavioral exemptions for Phoenix/Commanded work.
Phoenix 1.8, Postgres, Commanded, Ecto, ExUnit, Dialyzer, and strict static-check conventions.
Process Forgejo PR feedback with reflection, guardrail-gap classification, and inline thread replies.
Classify review feedback and choose proportionate guardrails without inflating default context cost.
Write implementation plans as test-addressed red-green-refactor cycles rather than component waterfalls.
| name | security-threat-model |
| description | Phoenix auth/session/CSRF, command authorization, event data sensitivity, Postgres, dependency, secret, and threat-model review triggers. |
Use this skill when changes touch Phoenix auth, sessions, CSRF, LiveView, command authorization, event payload PII, Postgres access, webhooks, background jobs, secrets, dependencies, or deployment.
Read docs/THREAT-MODEL.md and the relevant ADRs before changing security-sensitive behavior when those files exist. If the change introduces a new threat boundary and no threat model exists yet, call that out explicitly.
If a documented threat changes, update the matching security test when needed. Deployment, telemetry, or alerting changes may require updates to operations docs and monitoring contracts.
