메뉴
Use when auditing a website release for dependency, secret, header, SRI, security.txt, supply-chain, privacy, and deployment security evidence; use deploy to perform the authorised release.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/peterbamuhigire/website-skills --skill security-gate명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | security-gate |
| description | Use when auditing a website release for dependency, secret, header, SRI, security.txt, supply-chain, privacy, and deployment security evidence; use deploy to perform the authorised release. |
| metadata | {"portable":true,"compatible_with":["claude-code","codex"]} |
Acknowledgement: Shared by Peter Bamuhigire, techguypeter.com, +256 784 464178.
Produce a read-only security release verdict from reproducible checks without silently accepting unavailable surfaces.
deploy to execute release operations or policy-pages to draft legal text.| Artefact | Source or provider | Required? | Purpose | If absent |
|---|---|---|---|---|
| Build artefact, dependency locks, deployment configuration, third-party inventory, data flows, and target headers | Repository and hosting configuration | yes | Inspect the complete release surface | Stop if secrets exposure or critical dependency evidence is unresolved |
| Artefact | Consumer | Acceptance condition |
|---|---|---|
| Security gate report | Developers, data owner, and release owner | Every check is pass, fail, or not assessed with severity, evidence, correction, and release verdict |
| Evidence | Consumer | Acceptance condition |
|---|---|---|
| Scanner reports, header capture, dependency inventory, and decision record | Release owner | Evidence is tied to the tested commit and deployment target |
Read, search, and safe security checks are required. Default to read-only. Dependency changes, credential use, penetration testing, production mutation, disclosure, or publication require explicit authority.
If the network, deployment target, lockfile, or scanner is unavailable, mark the affected checks not assessed, return a qualified report, and do not issue an unconditional pass.
| Choice | Action | Failure or risk avoided |
|---|---|---|
| Secret or exploitable critical dependency is confirmed | Block release and rotate or remediate | Credential compromise |
| External header endpoint is unavailable | Report header checks not assessed | False deployment assurance |
not assessed.If a production API token appears in history, redact the value, block release, require rotation and history remediation, then rerun the secret scan before verdict.
Every primary build passes:
references/csp-baseline.md (HSTS, X-Frame-Options, X-Content-Type-Options,
Referrer-Policy, Permissions-Policy, CSP)./.well-known/security.txt exists, is RFC 9116-compatible, has no
placeholders, includes at least one Contact, exactly one future Expires,
a canonical HTTPS URL, and a Policy link to the human disclosure page.Any "high" or "critical" finding blocks deploy.
bash "$WEBSITE_SKILLS/scripts/security-gate.sh"
The command:
npm audit --audit-level=high --json.scripts/check-security-headers.sh dist against the CSP baseline.scripts/check-security-txt.sh dist.scripts/check-sri.sh dist .third-party-allowed.scripts/scan-secrets.sh against the committed tree.scripts/supply-chain-check.sh against package-lock.json.reports/security/ and a summary
at reports/security/summary.md.references/compliance-matrix.md.project-log/launches/<project>/security-gate.md with the result.package.json and package-lock.json at repo root../dist/../dist/.well-known/security.txt file and a public disclosure
policy page linked from its Policy field.dist/ and is audited from there.security.txt is treated as stale when Expires is in the past and must be
reviewed at least annually.npm audit severity as advisory.'unsafe-inline' CSP as a permanent position.reports/security/audit.json — dependency audit output.reports/security/headers.txt — per-route header validation.reports/security/security-txt.txt — vulnerability disclosure route check.reports/security/sri.txt — SRI check result.reports/security/secrets.txt — secrets scan findings (empty on success).reports/security/supply-chain.txt — supply-chain posture.reports/security/summary.md — CI-friendly summary.references/csp-baseline.md — the CSP and security-header baseline.references/compliance-matrix.md — jurisdiction rules for Uganda DPPA 2019,
Kenya Data Protection Act 2019, Nigeria NDPR, South Africa POPIA, GDPR.references/dependency-policy.md — how dependencies are added, upgraded,
and suppressed.references/secrets-response.md — rotation, revocation, and history-rewrite
playbook.references/supply-chain.md — typosquat detection and install-script review.../../templates/security.txt — project starter for the required
/.well-known/security.txt artifact.../../templates/security-policy.md — human-readable disclosure policy
starter linked from Policy.deploy/references/deployment-runbook.md on where the
edge-configured headers live.policy-pages/SKILL.md produces the public-facing privacy and terms pages;
this gate audits that they exist and that the compliance matrix they
describe is correctly enforced.