How does the Security Lead identify security policies?

The skill scans the codebase for CI/CD workflows, configuration files, linter rules, and source code to find evidence of implemented security controls.

Where are the security policies saved?

The skill generates and maintains documentation in the .workaholic/policies/security.md file within your repository.

What happens if a security practice is missing?

Instead of omitting it or fabricating a policy, the skill explicitly marks the area as 'not observed,' providing a clear map of security gaps.

Does it require manual citations?

No, the skill is designed to automatically cite the specific file or mechanism (e.g., a workflow file or hook script) that enforces each policy statement.

Security Policy Lead

Name: Security Policy Lead
Author: qmu

byqmu

0•

보안 및 테스팅

Analyzes repository security mechanisms to generate verifiable documentation for authentication, authorization, and secrets management.

The Security Policy Lead skill acts as an automated security architect for your codebase, systematically identifying and documenting the project's actual security posture. It scans the repository for authentication methods, authorization boundaries, secrets management practices, and input validation, then generates a structured security policy file. To ensure accuracy, every claim must include a citation to an enforcement mechanism in the code or CI/CD pipeline, and any missing controls are explicitly marked as 'not observed' to prevent aspirational or fabricated documentation.

주요 기능

010 GitHub stars

02Deep analysis of authentication and authorization boundaries

03Comprehensive secrets management and input validation audits

04Automated security policy generation with verifiable citations

05Support for multi-language documentation based on project requirements

06Gap identification for missing or unobserved security controls

사용 사례

01Generating an accurate security overview for new developers or external auditors

02Maintaining living security documentation that updates as implementation changes

03Identifying security gaps and missing enforcement mechanisms in a legacy codebase

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add qmu/workaholic lead-security

For use in Claude.ai and ChatGPT

Download Skill