Security engagement
You are the lead. This skill has no scripts of its own — it is the
procedure that sequences secure-code-review, threat-modeling,
security-test-planning and risk-register, and the dispatches to
security-reviewer and threat-modeler in between. You run the row
verbs and the read-only commands yourself; the emitter-only events
(fixed, regressed, acceptance-expired) are appended by the
scripts, never typed by you.
The one procedure
references/workflow.md is the only place the 11-step operator
flow lives — one fenced command per step, with the result line that
tells you it worked. Do not restate the steps elsewhere; point at this
file. In brief: start the engagement, dispatch the review, check it,
get second opinions where warranted, register the verified findings,
dispatch the threat model, admit and hand off the candidate cases,
report, verify fixes, record acceptances, sign off.
References
references/workflow.md — the 11 steps, in spec §7 order, each a
fenced command plus its expected result line.references/sign-off-checklist.md — spec §7 step 11 in full: the
four checks (cite.mjs check on findings and on the threat model,
cases.mjs verify-suite, register.mjs status plus a clean git status), what "OK" lets you say, and what to hand over.references/tracker-rules.md — filing a finding: search first
through issue-tracking, post, then register.mjs ticket <R-id> <url>. Threats are not ticketed in v1.
Standalone vs factory install
Installed alone (--skills security-testing/security-engagement), this
skill still expects the sibling skills — secure-code-review,
threat-modeling, security-test-planning, risk-register — to be
installed too; it names their scripts by relative path
(../secure-code-review/scripts/cite.mjs, and so on) rather than
shipping copies. Install the whole security-testing factory
(--factory security-testing) to get the lead role, the specialist
agents, and all five skills together with one engagement.md shared
across them. REGISTER: skipped (risk-register not installed) from
verify.mjs, and no register.mjs/cases.mjs commands to run in
references/workflow.md, are what a secure-code-review-only install
looks like — this skill is not that install.
What this skill does not do
It does not read code, write findings, derive a threat model, write
test cases, or hold the register's log — every one of those lives in
the skill named for it. It sequences them, dispatches the two agent
roles, and is where the sign-off prose lives because no single command
in this bundle produces a sign-off verdict.
1---2name: security-engagement3description: Use when running a security engagement end to end as the lead — init, review, register, model, cases, hand-off, report, fix, acceptances, sign-off; points at the other security-testing skills rather than duplicating their commands.4license: MIT5---67# Security engagement89You are the **lead**. This skill has no scripts of its own — it is the10procedure that sequences `secure-code-review`, `threat-modeling`,11`security-test-planning` and `risk-register`, and the dispatches to12`security-reviewer` and `threat-modeler` in between. You run the row13verbs and the read-only commands yourself; the emitter-only events14(`fixed`, `regressed`, `acceptance-expired`) are appended by the15scripts, never typed by you.1617## The one procedure1819`references/workflow.md` is the **only** place the 11-step operator20flow lives — one fenced command per step, with the result line that21tells you it worked. Do not restate the steps elsewhere; point at this22file. In brief: start the engagement, dispatch the review, check it,23get second opinions where warranted, register the verified findings,24dispatch the threat model, admit and hand off the candidate cases,25report, verify fixes, record acceptances, sign off.2627## References2829- `references/workflow.md` — the 11 steps, in spec §7 order, each a30 fenced command plus its expected result line.31- `references/sign-off-checklist.md` — spec §7 step 11 in full: the32 four checks (`cite.mjs check` on findings and on the threat model,33 `cases.mjs verify-suite`, `register.mjs status` plus a clean `git34 status`), what "OK" lets you say, and what to hand over.35- `references/tracker-rules.md` — filing a finding: search first36 through `issue-tracking`, post, then `register.mjs ticket <R-id>37 <url>`. Threats are not ticketed in v1.3839## Standalone vs factory install4041Installed alone (`--skills security-testing/security-engagement`), this42skill still expects the sibling skills — `secure-code-review`,43`threat-modeling`, `security-test-planning`, `risk-register` — to be44installed too; it names their scripts by relative path45(`../secure-code-review/scripts/cite.mjs`, and so on) rather than46shipping copies. Install the whole `security-testing` factory47(`--factory security-testing`) to get the lead role, the specialist48agents, and all five skills together with one `engagement.md` shared49across them. `REGISTER: skipped (risk-register not installed)` from50`verify.mjs`, and no `register.mjs`/`cases.mjs` commands to run in51`references/workflow.md`, are what a `secure-code-review`-only install52looks like — this skill is not that install.5354## What this skill does not do5556It does not read code, write findings, derive a threat model, write57test cases, or hold the register's log — every one of those lives in58the skill named for it. It sequences them, dispatches the two agent59roles, and is where the sign-off prose lives because no single command60in this bundle produces a sign-off verdict.
arozumenko