Shipmates
All commands

Command

/shipmates-harden

threat-model → remediate → re-review

Threat-model a surface, rank findings, fix blockers — or just report.

See it run

Illustrative terminal recording of the stages /shipmates-harden runs, in order.
Illustrative — the stages /shipmates-harden runs, in order.

How to run it

Run it in your harness

/shipmates-harden <what to harden — a module, an endpoint, an auth flow, or the whole app>

<angle brackets> = required · [square brackets] = optional

How it works

Security-engineer always threat-models. An engineer remediates only if you asked for a PR; the default is a report. Security then re-reviews the same surface.

  1. Scope

    Name the entry points, trust boundaries, and what is out of play.

    No specialist yet — you name the surface.

  2. Find

    Walk threats and rank them by severity. Nothing Critical or High may hang without a written call.

    Crew

    security-engineer

  3. Decide

    Default is report-only. A PR run has an engineer fix blockers, or record accepted risk in writing.

    Sit when

  4. Close

    Re-review the remediated surface until nothing Critical or High is hanging.

    Crew

    security-engineer

When to use

  • Auth, secrets, or another sensitive surface needs a security pass.
  • /ship-issue may recommend this; it does not replace it.

The skill

The installer ships the full skill — stages, gates, config — from commands/shipmates-harden.md.

Read the skill on GitHub

Other commands

All commands