Meta Security Review Bundle
DevOps & Securitymeta-security-review-bundleMeta Security Review Bundle is an Agent Skill for devops & security published in the opensquilla/opensquilla repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Compose three independent security gates over a candidate operation — policy/governance review, secret/credential scan, and audit-log emit — then arbitrate the verdicts with a strict priority rule (governance DENY > scanner WARN > ALLOW). Use when reviewing a proposed code change, script, or environment manipulation for safety.
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/opensquilla/opensquilla/blob/HEAD/src/opensquilla/skills/exp/meta-security-review-bundle/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/meta-security-review-bundle, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Security Review Bundle (Combinator Meta-Skill)
A combinator-style meta-skill: three independent gates run in parallel over the candidate operation, then a fourth step arbitrates the verdicts with a strict priority rule. The fifth step emits an audit record so the run is recallable later.
This bundle is the OpenSquilla equivalent of pptx slide 7's combinator pattern: multiple rule sets active simultaneously, with the arbitration rule explicit in the SKILL.md rather than implicit in the LLM's good judgement.
Arbitration rule
The arbitrate step encodes the priority policy > scanner > allow
verbatim in its task prompt. The rule is not soft-suggested
("consider whether…"); it's an enforceable check (startswith("DENY")).
This follows the pptx slide 7 recommendation to combine extensive scenario
testing with an explicit non-negotiable-rule fallback sentence.
Fallback
If any of the three primary gates fails (sub-agent error, timeout,
empty deliverable), the orchestrator's existing failure cascade
produces a structured failure payload. Operators should review the
partial verdicts in step_outputs and decide manually.
Use sparingly
This pattern multiplies token cost by N (number of gates) for a single user turn. Don't reach for the combinator unless multiple independent rule sets genuinely must both apply — otherwise prefer an orchestrator with a single, well-defined sequence.