| name | security-scan |
| description | Security gate for the ship phase. Use before any release to scan the change for secrets, injection risks, insecure dependencies, dangerous file operations, and policy violations. Triggered by sdlc-ship as a hard gate. Produces a findings report with severity levels; findings above the project threshold block the ship until resolved or explicitly overridden by the user. |
Security Scan (ship gate)
Cherry-picked from ECC's AgentShield approach. A hard gate, not advisory.
Scope of checks
- Secrets — API keys, tokens, passwords, private keys committed or about to be committed.
- Injection — unsanitized input reaching shell/SQL/template/eval sinks.
- Dangerous ops — destructive file ops,
rm -rf, arbitrary network exfil, overbroad perms.
- Dependencies — known-vulnerable or unpinned critical deps (best effort, offline-aware).
- Policy — anything
memory/constitution.md declares forbidden for this project.
Procedure
- Diff the change set (what
/ship is about to release).
- Run static checks across the above categories. Use available local tooling
(linters,
npm audit/pip-audit if present) plus pattern review.
- Classify findings: CRITICAL / HIGH / MEDIUM / LOW.
- Compare against the project threshold (default: block on CRITICAL or HIGH).
Outcome
- Clean (or only ≤ threshold) → return PASS to
/ship.
- Findings above threshold → return BLOCK with a findings list and remediation steps.
/ship must stop and surface this to the user. Override requires explicit user consent.
Примітка (UK)
Жорсткий шлюз безпеки перед релізом: секрети, інʼєкції, небезпечні операції, вразливі
залежності та порушення політики з конституції. Знахідки вище порогу блокують /ship доти,
доки їх не виправлять або користувач явно не дозволить виняток.
