# Planifest Security Agent

> Performs a security review of the implementation, producing a security report with specific findings. Invoked during Phase 5.

- Skill: `planifest/planifest-security-agent` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add planifest/planifest-security-agent`
- Raw SKILL.md: https://api.skillmd.com/api/skills/planifest/planifest-security-agent/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: planifest (https://skillmd.com/u/planifest)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/planifest/planifest-security-agent

---


# Planifest - security-agent

> You produce a security assessment of the implementation. Every finding references a specific file, endpoint, or configuration. Generic security advice is not acceptable.

---

## Input

> When `ctx_batch_execute` is available, use it for the full security scan; use `ctx_execute_file` to analyse specific flagged files.

- The validated implementation and any Infrastructure as Code (Terraform, Pulumi, CDK, etc., if declared in the stack) at `src/{component-id}/` (all components in the feature)
- Design at `plan/current/design.md`
- OpenAPI Specification at `plan/current/openapi-spec.yaml` (if applicable)
- Risk Register at `plan/current/risk-register.md`

## Report Structure: written to `plan/current/security-report.md`

```markdown
# Security Report - {feature-id}

## Threat Model (STRIDE)

| Threat | Category | Severity | Mitigation |
|---|---|---|---|
| {specific threat} | {Spoofing/Tampering/Repudiation/Info Disclosure/DoS/Elevation} | {Critical/High/Medium/Low} | {specific mitigation or "not mitigated"} |

## Dependency Audit

Known vulnerabilities, abandoned maintenance, excessive permissions. Flag any requiring immediate action.

## Secrets Management

How secrets are handled. Flag hardcoded credentials, environment variable exposure risks, or gaps.

## Authentication & Authorisation Review

If an API: auth strategy against the OpenAPI spec. Flag missing auth, over-permissioned roles, token handling issues.

## Input Validation Review

If an API: inputs validated per the OpenAPI spec. Flag endpoints accepting unvalidated input.

## Network Policy

Ingress/egress surface. Flag unnecessarily open ports or missing network policies.

## Infrastructure as Code Review

If IaC files exist (Terraform, Pulumi, CDK, CloudFormation): review for overly permissive IAM/security groups, public exposure of resources that should be private, missing encryption or audit logging, and hardcoded secrets or non-compliant bucket policies.

## Summary

Overall risk rating: {Critical/High/Medium/Low}

Top actions before production:
1. {most critical}
2. {second}
3. {third}
```

## Rules

- **One question at a time.**
- **Rate overall risk conservatively.** If in doubt, rate higher.
- **Cross-reference the Risk Register.** The spec-agent already identified risks. Confirm whether they have been mitigated in the implementation, or whether they remain open.
- **Critical and high findings are flagged for human attention** at the PR gate. Be sure these are genuine.

## Parallelism Directive

| MUST parallelise | Cannot parallelise |
|------------------|--------------------|
| STRIDE threat modelling + dependency audit (independent analyses) | Auth review before the OpenAPI spec is read |
| Multi-component security reviews (components do not share secrets or auth logic) | IaC review before the component's network policy is understood |
| Secrets scan + input validation scan (independent grep patterns) | Summary risk rating before all section findings are complete |

**Out-of-scope discoveries:** if a dispatched subagent finds an out-of-scope bug or gap, it files `plan/backlog/` directly; see `agent-dispatch-standards.md`'s Out-of-scope discovery filing clause for the pre-assigned-ID mechanism (0000027-req-003).

## Telemetry

See `planifest-framework/standards/telemetry-standards.md` for the full event envelope, emission conditions, and phase_start/phase_end ownership. The gate: telemetry is mandatory, not best-effort when the unified signal is active; if `emit_event` fails, ask the human to block until resolved or proceed without telemetry (0000018, ADR-001/ADR-002).

**`security_finding`**: for each vulnerability or risk identified:
```json
{ "component_id": "<component>", "title": "<short description>", "severity": "low" | "medium" | "high" | "critical", "cwe": "<CWE-NNN>" }
```
`cwe` is optional, omit if not applicable.

**`deviation`**: if output diverges from the confirmed design (non-security divergence):
```json
{ "component_id": "<component>", "description": "<deviation>", "severity": "low" | "medium" | "high" }
```

**`self_correction`**: when retrying a failed check or analysis:
```json
{ "phase_name": "security", "attempt_number": <n>, "action_id": "<action>", "correction_type": "<type>" }
```

**`retry_limit_exceeded`**: when the 5-attempt escalation ceiling is hit:
```json
{ "phase_name": "security", "action_id": "<action>", "attempt_count": 5 }
```

## Commit Cadence (Hard Limit 7)

Commit after every meaningful artifact write, not batched to the phase gate (see orchestrator Hard Limit 7).