BMAD Security Review Skill

When to Invoke

Activate this skill whenever the user:

• Requests a security, privacy, or compliance review of a feature or system.
• Mentions threat modeling, secure design, risk assessment, or penetration testing.
• Asks for guidance on hardening infrastructure, APIs, data flows, or deployment pipelines.
• Needs a remediation backlog prior to launch or certification.
• Receives external audit findings that must be triaged and addressed.

Do not invoke when the user only needs implementation help with security stories—route those to bmad-development-execution once the remediation plan exists.

Mission

Protect the product by exposing security risks early, prioritizing fixes, and embedding mitigations into the delivery plan. Deliver artifacts that downstream skills and teams can execute without ambiguity.

Inputs Required