neohaskell/docs/archive/2026-07-ai-artifacts/claude-skills/feature-pipeline-preview/12-security-impl
docs/archive/2026-07-ai-artifacts/claude-skills/feature-pipeline-preview/12-security-impl/SKILL.md
> **ARCHIVAL KNOWLEDGE — DO NOT USE OR REFERENCE.** > Superseded by `codemap/` + root `AGENTS.md`. Scheduled for deletion once the pipeline is verified (Phase 6). > Manifest: `docs/archive/2026-07-ai-artifacts/MANIFEST.md` --- name: 12-security-impl description: Runs the implementation-phase security review with a static scan, deep audit, grounding, and record. kind: process executor: haiku model: claude-haiku-4-5-20251001 --- # Security Review (Implementation) Produces `.pipeline/findings-12
$ install --global
skillsauthnpx skillsauth add neohaskell/neohaskell docs/archive/2026-07-ai-artifacts/claude-skills/feature-pipeline-preview/12-security-implInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 8, 2026, 7:46 AM352.8s5 files scanned
SKILL.md
ARCHIVAL KNOWLEDGE — DO NOT USE OR REFERENCE. Superseded by
codemap/+ rootAGENTS.md. Scheduled for deletion once the pipeline is verified (Phase 6). Manifest:docs/archive/2026-07-ai-artifacts/MANIFEST.md
name: 12-security-impl description: Runs the implementation-phase security review with a static scan, deep audit, grounding, and record. kind: process executor: haiku model: claude-haiku-4-5-20251001
Security Review (Implementation)
Produces .pipeline/findings-12.json with grounded security findings against the actual implementation.
Steps
- Static scan — read
./01-static-scan/SKILL.mdand follow it. Verify: stdout is a JSON array. - Deep audit — spawn an Agent (model: sonnet) and instruct it to read
./02-deep-audit/SKILL.mdand follow it, piping in the step 1 output. The leaf merges those static-scan findings with its own deep findings before emitting (dedup byrule+location); the static-scan list is never discarded. Verify: stdout is a JSON array withfile:linelocations. - Ground — spawn an Agent (model: sonnet) and instruct it to read
./03-ground/SKILL.mdand follow it, piping in the step 2 output. Verify: stdout hasgrounding_outcomeon every entry. - Record — read
./04-record/SKILL.mdand follow it, piping in the step 3 output. Verify:.pipeline/findings-12.jsonexists and phase 12 is marked complete.
Walk these steps in order. After each, run the verify check before continuing. If a verify fails, stop and surface.
Shared invariants
- Findings are tied to
file:linereferences in the actual implementation. - Grounding is mandatory — even zero findings produce an audit record.
- Static-scan output is folded into the deep-audit's emitted findings (union, dedup by
rule+location); the static-scan list is never replaced or dropped silently.
Related Skills
neohaskell/docs/archive/2026-07-ai-artifacts/claude-skills/neohaskell-style-guide
development
VerifiedTrustedCommunity
> **ARCHIVAL KNOWLEDGE — DO NOT USE OR REFERENCE.** > Superseded by `codemap/` + root `AGENTS.md`. Scheduled for deletion once the pipeline is verified (Phase 6). > Manifest: `docs/archive/2026-07-ai-artifacts/MANIFEST.md` --- name: neohaskell-style-guide description: NeoHaskell coding style reference and enforcement rules. Load when writing, reviewing, or modifying any Haskell code in the NeoHaskell project. Triggers on 'NeoHaskell style', 'NeoHaskell conventions', 'how to write NeoHaskell', '
347SKILL.mdUpdated Jul 9, 2026
neohaskell/docs/archive/2026-07-ai-artifacts/claude-skills/neohaskell-security-review
development
VerifiedTrustedCommunity
> **ARCHIVAL KNOWLEDGE — DO NOT USE OR REFERENCE.** > Superseded by `codemap/` + root `AGENTS.md`. Scheduled for deletion once the pipeline is verified (Phase 6). > Manifest: `docs/archive/2026-07-ai-artifacts/MANIFEST.md` --- name: neohaskell-security-review description: Security & Code Quality review for NeoHaskell. Use when reviewing code changes, PRs, or architectural decisions for security implications. Evaluates OWASP, NIST, EU compliance. Handles pipeline phases 2 (ADR review) and 10 (im
347SKILL.mdUpdated Jul 9, 2026
neohaskell/docs/archive/2026-07-ai-artifacts/claude-skills/neohaskell-qa-designer
development
VerifiedTrustedCommunity
> **ARCHIVAL KNOWLEDGE — DO NOT USE OR REFERENCE.** > Superseded by `codemap/` + root `AGENTS.md`. Scheduled for deletion once the pipeline is verified (Phase 6). > Manifest: `docs/archive/2026-07-ai-artifacts/MANIFEST.md` --- name: neohaskell-qa-designer description: Testing QA Designer for NeoHaskell. Designs comprehensive test specifications with exhaustive edge cases, boundary conditions, and happy paths BEFORE implementation. Handles pipeline phase 6 (Test Spec Design). Outside-in TDD meth
347SKILL.mdUpdated Jul 9, 2026
neohaskell/docs/archive/2026-07-ai-artifacts/claude-skills/neohaskell-performance-review
development
VerifiedTrustedCommunity
> **ARCHIVAL KNOWLEDGE — DO NOT USE OR REFERENCE.** > Superseded by `codemap/` + root `AGENTS.md`. Scheduled for deletion once the pipeline is verified (Phase 6). > Manifest: `docs/archive/2026-07-ai-artifacts/MANIFEST.md` --- name: neohaskell-performance-review description: Performance review for NeoHaskell targeting 50k req/s throughput. Use when reviewing code for performance implications, INLINE pragmas, strictness, and allocation patterns. Handles pipeline phases 3 (ADR review) and 11 (imp
347SKILL.mdUpdated Jul 9, 2026