# Planning Security Scope

> Use when a delivery run's freshly produced planning scope needs its functional security surface reviewed: which actors and actions are security-sensitive, what the abuse cases are, and what access assumptions the requirements silently make. This is the planning_security_scope action of the planning stretch — one Agent-tool dispatch with subagent_type security-reviewer — a requirements-level security read, distinct from security-architecture-review (design-level) and security-review (implementation-level).

- Skill: `bhangeef16/planning-security-scope` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bhangeef16/planning-security-scope`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bhangeef16/planning-security-scope/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: BhangeeF16 (https://skillmd.com/u/bhangeef16)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bhangeef16/planning-security-scope

---


# Planning Security Scope

Review the planning output for its functional security scope. This is a requirements-level pass: it names what is sensitive and how it could be abused, before any design exists to review.

## Dispatch

One synchronous `Agent`-tool call, `subagent_type: security-reviewer`. The persona file carries the domain lens; this skill defines the action's own contract.

## Required inputs

- `planning.md` for the target.

## Required outputs (all mandatory)

- Security-sensitive actors and actions, named explicitly.
- Abuse cases for the sensitive workflows.
- Access assumptions the requirements make (tenant scope, resource scope, role expectations), stated so later stages can validate them instead of rediscovering them.

## Result

Report each required output produced (with its location), the result (pass / pass_with_risks / blocked / failure), and blocking questions as an explicit list (empty list stated explicitly).