security-plan-gap

# Security Plan Gap ## Overview Find missing security requirements before code exists. This skill turns design omissions into actionable plan additions. ## When to Use - writing a feature plan or architecture - reviewing a spec before implementation starts - breaking work into tasks that may cross trust boundaries or handle sensitive data ## Workflow 1. Read the current plan, spec, or task breakdown. 2. Load `references/plan-gap-checklist.md`. 3. Load `../shared/common-web-threats.md`, `../shared/finding-schema.md`, and the relevant stack profile if known. 4. Produce a gap report with missing controls, risk scenarios, and suggested plan additions. 5. End with a closing coverage note using the shared headings: Reviewed / Not reviewed / Assumptions / Tools run. ## Guardrails - Treat missing requirements as gaps, not confirmed vulnerabilities. - Prefer concise, actionable additions over generic best-practice lists. - Lower confidence when the stack or architecture is only partly defined. - Treat this skill as the default planning-stage review pass when `codex-sentinel` invokes it automatically.