Сбор доказательств безопасности перед деплоем

security

vc-risk-evidence-pack is a Claude Code skill that defines and generates the manual-first evidence pack required before finalizing, pushing, or handing off high-risk implementation work. It covers 6 high-risk class definitions — auth/identity, billing/credits, schema/data migration, public API contracts, deploy/container/proxy behavior, and permission/trust-boundary logic — each triggering a structured documentation requirement. The pack consists of 5 artifacts: risk-gate.json, context-snippets.json, verification.json, review-decision.json, and adversarial-validation.json, colocated in the task folder under harness/ and validated by the bundled validate-risk-artifacts.mjs script. An Auto-Stop rule prevents reporting DONE if the pack is missing or the reviewer decision is unrecorded. Teams building multi-agent pipelines that need a reproducible compliance gate for security-sensitive changes will find this skill directly applicable.