meta-security-review-bundle

Security Review Bundle (Combinator Meta-Skill)

A combinator-style meta-skill: three independent gates run in

parallel over the candidate operation, then a fourth step arbitrates

the verdicts with a strict priority rule. The fifth step emits an

audit record so the run is recallable later.

This bundle is the OpenSquilla equivalent of pptx slide 7's combinator

pattern: multiple rule sets active simultaneously, with the arbitration rule

explicit in the SKILL.md rather than implicit in the LLM's good judgement.

Arbitration rule

The arbitrate step encodes the priority policy > scanner > allow

verbatim in its task prompt. The rule is not soft-suggested

("consider whether…"); it's an enforceable check (startswith("DENY")).

This follows the pptx slide 7 recommendation to combine extensive scenario

testing with an explicit non-negotiable-rule fallback sentence.

Fallback

If any of the three primary gates fails (sub-agent error, timeout,

empty deliverable), the orchestrator's existing failure cascade

produces a structured failure payload. Operators should review the

partial verdicts in step_outputs and decide manually.

Use sparingly

This pattern multiplies token cost by N (number of gates) for a

single user turn. Don't reach for the combinator unless multiple

independent rule sets genuinely must both apply — otherwise prefer

an orchestrator with a single, well-defined sequence.