Plans

Add User Gate to security-scrub Skill

Medium completed
2026-05-31 agentics feature Medium effort
Objective

Centralize the user-confirmation gate inside security-scrub so every caller automatically pauses for review after a scan — auto-proceeding only when the result is a clean PASS with zero findings, and hard-stopping (no Continue option) on any BLOCKED result.

Implement Read and implement all steps in the plan at docs/plans/add-security-scrub-user-gate.md — Add User Gate to security-scrub Skill. Verify against the plan's Tests, Verification, and Acceptance Criteria before reporting done. If everything passed, mark completion in docs/plans/add-security-scrub-user-gate.md — tick each step's [x] marker and each criterion's - [x], set status: completed — and re-render the HTML from the spec. If any check failed, leave status: in-progress and say which.
More ways to run this plan — goal & workflow prompts, file path
Pursue as goal — optimize for the outcome
Achieve this goal: Add User Gate to security-scrub Skill. The plan at docs/plans/add-security-scrub-user-gate.md describes one approach — use it as reference, but optimize for the outcome. Verify against the plan's Tests, Verification, and Acceptance Criteria before reporting done. If everything passed, mark completion in docs/plans/add-security-scrub-user-gate.md — tick each step's [x] marker and each criterion's - [x], set status: completed — and re-render the HTML from the spec. If any check failed, leave status: in-progress and say which.
File add-security-scrub-user-gate.html
Path docs/plans/add-security-scrub-user-gate.html
Spec docs/plans/add-security-scrub-user-gate.md
Definition of done 7 / 7 done

Context

The story behind this plan — what prompted the work and why it matters now.

The security-scrub skill lives in kit/plugins/social-media-tools/skills/security-scrub/SKILL.md . It scans content for secrets and emits a structured SCRUB RESULT block, then stops. Five callers depend on it: share-session , share-github , share-selection , share-project , and share-scan .

In v2.3.2, a user-confirmation prompt was added directly inside share-session (lines 187–188). The other four callers have no gate at all, so a BLOCKED or WARN result silently allows sharing to continue. The fix was partial — every caller must now implement its own gate independently, leading to divergence and future drift.

Moving the gate into security-scrub itself enforces it uniformly for all callers. For the "auto-trigger" use case: when the result is a clean PASS (no findings whatsoever), the skill proceeds without prompting — this is the automatic continuation path. Any findings (LOW, MEDIUM, or HIGH) pause for explicit user input before returning.

Steps

The step-by-step work, in order — each step says what to do, why it matters, and how to check it worked.

1
done Add AskUserQuestion to allowed-tools in security-scrub/SKILL.md
Why
Declaring every tool the skill calls in allowed-tools prevents a mid-run permission prompt; without it the harness blocks execution until the user manually approves.
Verify
Run head -6 kit/plugins/social-media-tools/skills/security-scrub/SKILL.md and confirm AskUserQuestion appears in the allowed-tools: line alongside the existing Bash, Read, Grep entries.
2
done Add Step 6 — User Gate to the security-scrub skill body with four result-driven branches
Why
The current five-step skill emits the SCRUB RESULT and exits, leaving callers responsible for gating. Centralizing the gate removes per-caller boilerplate and eliminates the risk that a future caller forgets to implement it.
Verify
Read the updated SKILL.md and confirm Step 6 is present with all four branches: BLOCKED (any HIGH finding or ALLOWLIST verdict BLOCKED) — hard stop message, no AskUserQuestion call, skill returns immediately. WARN (MEDIUM finding, no HIGH) — AskUserQuestion with caution language; options: "Continue anyway" / "Cancel — stop here". PASS with LOW findings — AskUserQuestion with informational note; options: "Continue" / "Cancel". PASS with no findings — no prompt; skill states "Clean — auto-proceeding" and returns normally.
3
done Remove the redundant AskUserQuestion gate from share-session/SKILL.md Phase 2
Why
share-session already calls security-scrub via Skill() ; with the gate now inside the skill, leaving it in share-session too would double-prompt the user on every scrub.
Verify
Open kit/plugins/social-media-tools/skills/share-session/SKILL.md and confirm lines referencing PASS → use AskUserQuestion (currently lines 187–188) are removed. Both the PASS → use AskUserQuestion instruction and the adjacent "BLOCKED = hard stop" documentation must also be removed — both are now enforced inside security-scrub and are redundant in the caller.
4
done Bump social-media-tools to v2.4.0 in .claude-plugin/marketplace.json and add a CHANGELOG entry
Why
Adding behavior that affects all callers (the user gate now fires from inside the skill for every invocation) is a new capability — a MINOR bump per the versioning table in .claude/rules/marketplace.md . Current version is 2.3.2.
Verify
Run python3 -c "import json; d=json.load(open('.claude-plugin/marketplace.json')); print(next(p['version'] for p in d['plugins'] if p['name']=='social-media-tools'))" from the repo root and confirm it prints 2.4.0 . Open kit/plugins/social-media-tools/CHANGELOG.md and confirm a v2.4.0 entry exists at the top.
5
done Commit all changes in a single conventional commit referencing this plan
Why
Per repo conventions, plan files are committed alongside the plugin changes they describe; leaving them uncommitted requires a second prompt and breaks traceability.
Verify
Run git status and confirm a clean working tree. Run git log -1 --oneline and confirm the commit message is a conventional commit of type feat(kit/plugins/social-media-tools) referencing the user gate change.

Definition of done

The plan counts as done when every statement below is true — check each one off as you verify it.

Final check

One last pass to confirm the whole change works end to end.

Read kit/plugins/social-media-tools/skills/security-scrub/SKILL.md end-to-end and confirm Step 6 is present with all four branches (BLOCKED hard-stop, WARN gate, PASS-with-LOW gate, PASS-clean auto-continue). Confirm AskUserQuestion is in allowed-tools .

Read kit/plugins/social-media-tools/skills/share-session/SKILL.md Phase 2 and confirm the AskUserQuestion post-scrub instruction is removed.

Run the marketplace version check command from Step 4 and confirm it prints 2.4.0 . Check the CHANGELOG for the v2.4.0 entry. Run git log -1 --oneline and confirm a single clean commit contains all four changed files: security-scrub/SKILL.md , share-session/SKILL.md , marketplace.json , CHANGELOG.md , and this plan file.

Wrapping up

Three gates that must all pass before this plan is marked completed.

Required

Completion Report

No items to report — all requirements met.

Next steps

Follow-up ideas that came up along the way — none of them are required to finish this plan.

Audit remaining callers for redundant post-scrub gates

Paste this prompt into Claude to execute this follow-up:

Audit the four remaining callers of security-scrub in kit/plugins/social-media-tools/skills/ — share-github, share-selection, share-project, and share-scan — and check whether any of them implement their own post-scrub user gate (AskUserQuestion or similar). If so, remove the redundant prompt and note the files changed. Do not change anything else.
Add --no-gate flag for caller-controlled suppression

Paste this prompt into Claude to execute this follow-up:

Update kit/plugins/social-media-tools/skills/security-scrub/SKILL.md to support an optional --no-gate flag in $ARGUMENTS. When the flag is present, Step 6 is skipped entirely and the skill exits immediately after emitting the SCRUB RESULT block, leaving gating to the caller. Document the flag in the Overview section. This allows callers that implement their own custom gate (e.g. a multi-step confirmation flow) to opt out of the built-in gate. Bump the version to 2.4.1 and add a CHANGELOG entry.
Auto-continue via PostToolUse hook when result is PASS/clean Wish List

Speculative / blue-sky idea — not on the critical path. Paste into Claude when ready to explore:

Paste this prompt into Claude to execute this follow-up:

Investigate whether a PostToolUse hook on the Skill tool could detect when security-scrub returns a clean PASS result and automatically inject a "continue" response into the conversation without user input. This would make the auto-continue path fully transparent rather than relying on the skill not calling AskUserQuestion. Research the hook event payload structure (does it include skill name and return value?) and assess feasibility. Report your findings and, if feasible, draft a minimal hook prototype.