# Meta Security Review Bundle

> Meta Security Review Bundle is an Agent Skill for devops & security published in the opensquilla/opensquilla repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Compose three independent security gates over a candidate operation — policy/governance review, secret/credential scan, and audit-log emit — then arbitrate the verdicts with a strict priority rule (governance DENY > scanner WARN > ALLOW). Use when reviewing a proposed code change, script, or environment manipulation for safety.

- Skill name: `meta-security-review-bundle`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/opensquilla/opensquilla/blob/HEAD/src/opensquilla/skills/exp/meta-security-review-bundle/SKILL.md
- Repository: opensquilla/opensquilla (6,081 GitHub stars when collected)

## SKILL.md

# Security Review Bundle (Combinator Meta-Skill)

A **combinator-style** meta-skill: three independent gates run in
parallel over the candidate operation, then a fourth step arbitrates
the verdicts with a strict priority rule. The fifth step emits an
audit record so the run is recallable later.

This bundle is the OpenSquilla equivalent of pptx slide 7's combinator
pattern: multiple rule sets active simultaneously, with the arbitration rule
explicit in the SKILL.md rather than implicit in the LLM's good judgement.

## Arbitration rule

The arbitrate step encodes the priority `policy > scanner > allow`
verbatim in its task prompt. The rule is **not** soft-suggested
("consider whether…"); it's an enforceable check (`startswith("DENY")`).
This follows the pptx slide 7 recommendation to combine extensive scenario
testing with an explicit non-negotiable-rule fallback sentence.

## Fallback

If any of the three primary gates fails (sub-agent error, timeout,
empty deliverable), the orchestrator's existing failure cascade
produces a structured failure payload. Operators should review the
partial verdicts in `step_outputs` and decide manually.

## Use sparingly

This pattern multiplies token cost by N (number of gates) for a
single user turn. Don't reach for the combinator unless multiple
independent rule sets *genuinely must* both apply — otherwise prefer
an orchestrator with a single, well-defined sequence.

---

Source: https://www.openparable.com/skill/devops-security/meta-security-review-bundle (OpenParable). Cite the canonical URL above.