メニュー
The composed security gate before going public or cutting a release: secret-scan + dependency-audit + sast-scan, in order, with a clear pass/triage report. The security sibling of ship-preflight — refuses to wave through unrotated secrets or shipped-runtime CVEs.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Route a task to the least intrusive executive-function support based on the user's stated current capacity, memory load, activation, and motivation. Use when work feels stuck, overwhelming, hard to hold in mind, or when the user asks for neurodivergent-friendly support without wanting a diagnostic or coaching ritual.
Reduce work to the smallest safe and useful outcome when capacity is low or burnout is present. Use when the user explicitly says they are depleted, overwhelmed, unable to start, or asks for the minimum viable version of a task.
Create a truthful activation bridge for a task that has low urgency, novelty, interest, challenge, or immediate feedback. Use when the user says they are stuck or avoiding a known task despite understanding it.
Reduce language, sensory, and uncertainty load while preserving complete information. Use when the user requests direct or scannable communication, has low capacity, is navigating a new flow, or needs explicit expectations and examples.
Turn a vague, oversized, or initiation-resistant outcome into an executable sequence with a visible first action and definition of done. Use when dependencies are hidden, the task spans multiple systems, or the user cannot identify where to begin.
Externalize time, checkpoints, stopping rules, and context transitions. Use when estimates are uncertain, a task may expand indefinitely, the user is switching topics, or an interruption risks losing the current state.
| name | security-preflight |
| description | The composed security gate before going public or cutting a release: secret-scan + dependency-audit + sast-scan, in order, with a clear pass/triage report. The security sibling of ship-preflight — refuses to wave through unrotated secrets or shipped-runtime CVEs. |
| created | "2026-06-27T00:00:00.000Z" |
| updated | "2026-06-27T00:00:00.000Z" |
| tags | ["security","preflight","gate","release","audit","secrets","cve","sast"] |
| triggers | [{"event":"PreToolUse","match":"git_push"}] |
One gate that runs the three scans in the order that matters and gives a single pass/triage verdict. The sibling of ship-preflight (which proves it works) — this proves it's safe to expose. Run it before a repo goes public and before any release tag. It is a gate, not a fix-all: it surfaces and blocks on the things that must not ship; remediation is the individual skills.
# 1. SECRETS — hard gate. A live secret in history blocks everything.
gitleaks detect --no-banner --redact
git ls-files | grep -iE '(^|/)\.env$|\.pem$|id_rsa|credentials|api-token|\.key$' # tracked-file check
# 2. DEPENDENCY CVEs — gate on SHIPPED-runtime highs; dev-only are notes.
npm audit --omit=dev # runtime deps (the ones that ship)
cargo audit # Rust
osv-scanner scan source --recursive . # multi-ecosystem, labels (dev)
# 3. SAST — your own code; gate on injection/traversal on reachable paths.
semgrep scan --config p/security-audit --config p/secrets .
Security preflight:
secrets — PASS (0 leaks, <n> commits) | FAIL (<what> — ROTATE then scrub)
deps (runtime)— PASS | FAIL (<pkg> <cve> <severity> — patch/override)
deps (dev) — <n> notes (dev-only, unreachable by shipped artifact)
sast — PASS | <n> findings (triaged: <real>/<false-positive>)
Overall: SAFE TO EXPOSE | BLOCKED on <which gate>
[[secret-scan]]), then scrub. Never "we'll rotate later."--omit=dev doesn't include them) — but log them, with the reason they're deferred. Silent omission reads as "covered everything."[[sast-scan]]).[[secret-scan]] · [[dependency-audit]] · [[sast-scan]]. Mirror of ship-preflight (functional gate) — run both before a release.