security-release-review

name	security-release-review
description	Review a public package for secrets, private paths, internal references, and overbroad release claims.

Security Release Review

Use When

Use this skill before publishing docs, examples, packages, command samples, or runtime artifacts.

Inputs

• changed files
• intended publication surface
• public claims
• known private systems or excluded materials
• scanner commands

Outputs

• exposure audit
• removed or approved references
• scanner results
• public claim verdict
• remaining private or deployment gaps

Rules

• Scan for credentials, private paths, internal hostnames, account details, and private operational references.
• Treat public examples as attacker-readable.
• Keep private tool mappings out of public docs.
• Replace internal blockers with neutral lifecycle or approval language.
• Do not hide safety boundaries that a reproducing builder needs.

Stop Conditions

• Any credential, private key, private path, or internal host reference is found.
• A public claim depends on unverified private infrastructure.
• The publication surface includes sensitive customer, account, or payment data.

Verification

Record the scanner commands and the remaining allowed generic security words or patterns.