Security assurance
Use when a dependency, snippet, or external source enters the project and needs licence, supply-chain, and untrusted-code review before it is adopted.From its SKILL.md
npx -y skills add Suraj787/motif --skill security-assuranceAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.2 KB, 214 tokens by cl100k_base, as published. Nobody here has run it
Security Assurance
Responsibility: Gate everything that enters the project from outside, dependencies, recipes, and snippets, on licence, supply-chain, and execution safety.
When to invoke
- Step 16 of the root workflow, and any time a new dependency or external source appears.
Inputs
- Proposed dependencies; registry/external sources; any code fetched from the internet.
Outputs
- A licence, security, and cost verdict per dependency or source.
- A supply-chain assessment (provenance, maintenance, known advisories).
- An adopt / reject / quarantine decision feeding the ledger.
Engine data + CLI
- Reads
assurance/security rules,security/, andpolicies/(licence policy). ii assure --security,ii deps review.
Notes
Never add a dependency without a licence, security, and cost review. Never execute unreviewed internet code. Never reconstruct premium or restricted components from previews. When provenance is unclear, quarantine rather than adopt.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.