# Meta Security Review Bundle

> Compose three independent security gates over a candidate operation — policy/governance review, secret/credential scan, and audit-log emit — then arbitrate the verdicts with a strict priority rule (governance DENY > scanner WARN > ALLOW). Use when reviewing a proposed code change, script, or environment manipulation for safety.

- Skill: `gabrielmoreira/meta-security-review-bundle` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/meta-security-review-bundle`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/meta-security-review-bundle/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/gabrielmoreira/meta-security-review-bundle

---


# Security Review Bundle (Combinator Meta-Skill)

A **combinator-style** meta-skill: three independent gates run in
parallel over the candidate operation, then a fourth step arbitrates
the verdicts with a strict priority rule. The fifth step emits an
audit record so the run is recallable later.

This bundle is the OpenSquilla equivalent of pptx slide 7's combinator
pattern: multiple rule sets active simultaneously, with the arbitration rule
explicit in the SKILL.md rather than implicit in the LLM's good judgement.

## Arbitration rule

The arbitrate step encodes the priority `policy > scanner > allow`
verbatim in its task prompt. The rule is **not** soft-suggested
("consider whether…"); it's an enforceable check (`startswith("DENY")`).
This follows the pptx slide 7 recommendation to combine extensive scenario
testing with an explicit non-negotiable-rule fallback sentence.

## Fallback

If any of the three primary gates fails (sub-agent error, timeout,
empty deliverable), the orchestrator's existing failure cascade
produces a structured failure payload. Operators should review the
partial verdicts in `step_outputs` and decide manually.

## Use sparingly

This pattern multiplies token cost by N (number of gates) for a
single user turn. Don't reach for the combinator unless multiple
independent rule sets *genuinely must* both apply — otherwise prefer
an orchestrator with a single, well-defined sequence.