meta-security-review-bundle
Compose three independent security gates over a candidate operation — policy/governance review, secret/credential scan, and audit-log emit — then arbitrate the verdicts with a strict priority rule (governance DENY > scanner WARN > ALLOW). Use when reviewing a proposed code change, script, or environment manipulation for safety.
Profile →npx skills add opensquilla/opensquilla --skill meta-security-review-bundle --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Review Bundle (Combinator Meta-Skill) A **combinator-style** meta-skill: three independent gates run in parallel over the candidate operation, then a fourth step arbitrates the verdicts with a strict priority rule. The fifth step emits an audit record so the run is recallable later. This bundle is the OpenSquilla equivalent of pptx slide 7's combinator pattern: multiple rule sets active simultaneously, with the arbitration rule explicit in the SKILL.md rather than implicit in the LLM's good judgement. ## Arbitration rule The arbitrate step encodes the priority `policy > scanner > allow` verbatim in its task prompt. The rule is **not** soft-suggested ("consider whether…"); it's an enforceable check (`startswith("DENY")`). This follows the pptx slide 7 recommendation to combine extensive scenario testing with an explicit non-negotiable-rule fallback sentence. ## Fallback If any of the three primary gates fails (sub-agent error, timeout, empty deliverable), the orchestrator's existing failure cascade produces a structured failure payload. Operators should review the partial verdicts in `step_outputs` and decide manually. ## Use sparingly This pattern multiplies token cost b
- Arbitration rule
- Fallback
- Use sparingly
What does the meta-security-review-bundle skill do?
Compose three independent security gates over a candidate operation — policy/governance review, secret/credential scan, and audit-log emit — then arbitrate the verdicts with a strict priority rule (governance DENY > scanner WARN > ALLOW). Use when reviewing a proposed code change, script, or environment manipulation for safety.
How do I install it?
Run `npx skills add opensquilla/opensquilla --skill meta-security-review-bundle --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From opensquilla/opensquilla, a repository with 6,515 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.