edercnj/x-review-security

Skill: Security Compliance Review

Purpose

Review code changes against the compliance frameworks selected in the project configuration. Verify sensitive data handling, audit trails, access control patterns, and cryptography usage per active framework requirements.

Activation Condition

Include this skill when the project has compliance frameworks configured (PCI-DSS, LGPD, GDPR, HIPAA, SOX).

Triggers

• /x-review-security 42 -- review PR #42 for security compliance
• /x-review-security src/main/java/com/example/auth/ -- review specific file paths
• /x-review-security -- review all current changes

Parameters

| Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | target | String | No | (current changes) | PR number or file paths to review |

Phase 0.1 — Load Agent Context

Resolve agent name: use --agent runtime flag if provided; otherwise default to security-engineer (this skill's statically bound agent).

Skill(skill: "x-internal-load-agent-context", args: "--agent {resolved_agent_name}")

Adopt agent_context.persona. Follow agent_context.rules. Read all agent_context.core_knowledge paths before proceeding. If agent_context.status == "error": halt and report agent_context.message.

Canonical Technology Selection

Use the canonical selector as the single source of truth for review assets:

Skill(skill: "x-internal-select-context-packs",
      args: "--phase review --capabilities security,compliance,java,api")

Consumption rules:

1. Read every path returned in required.
2. Read recommended only when relevant to the changed scope.
3. Do not duplicate static pack lists when the selector already covers the same asset.
4. Read optional only with explicit justification in findings.

Explicit Domain Exceptions (only when applicable)

• Read src/knowledge/shared/compliance-knowledge/compliance/knowledge.md when any compliance framework is active.
• Read src/knowledge/shared/security-knowledge/pci-dss-requirements/knowledge.md only when PCI-DSS is active.

Workflow

Step 1 -- Gather Context

Collect the review target: PR number or file paths from args. Run:

git diff --name-only HEAD~1..HEAD 2>/dev/null || git diff --name-only --cached

Step 2 -- Dispatch to Security Engineer Agent

Agent(
  subagent_type: "security-engineer",
  description: "Security specialist review for {target}",
  prompt: "Review the code changes for security compliance. Target: {target}. Run `git diff HEAD~1..HEAD` to get the diff. Resolve packs via `x-internal-select-context-packs --phase review --capabilities security,compliance,java,api` and consume selector output: read all `required`, then only security-relevant `recommended` assets. Treat compliance files as explicit exceptions (`compliance.md` for active frameworks; `pci-dss-requirements.md` only when PCI-DSS is active). Apply your full security checklist including sensitive data handling, input validation, auth/authz, defensive coding, and all active compliance framework checks. Produce output in this exact format:\n\nENGINEER: Security\nSTORY: {target}\nSCORE: XX/30\nSTATUS: Approved | Rejected | Partial\n---\nPASSED:\n- [SEC-XX] Description (2/2) | Evidence: {brief concrete observation}\nFAILED:\n- [SEC-XX] Description (0/2) -- file:line -- Fix: suggestion [SEVERITY]\nPARTIAL:\n- [SEC-XX] Description (1/2) -- file:line -- Improvement: suggestion [SEVERITY]"
)

Output Format

## Compliance Review — [Change Description]

### Active Frameworks: [list]

### Per-Framework Results

#### [Framework Name]
- [x] Requirement met / [ ] Gap identified
- Finding: [description + remediation]
- Evidence: {brief concrete observation for passed items}

### Checklist Results (all items)

PASSED:
- [SEC-XX] [Item description] | Evidence: {brief concrete observation}

FAILED:
- [SEC-XX] [Item description] -- file:line -- Fix: [guidance] [SEVERITY]

### Overall Verdict: COMPLIANT / NON-COMPLIANT / NEEDS REVIEW

Error Handling

Convenções de erro/degradação transversais a review/audit (empty input, RULE-012 template fallback, falha de specialist, build/test override, idempotência) vivem em _shared/error-handling-review.md. As linhas abaixo são específicas desta skill.

| Scenario | Action | |----------|--------| | No compliance frameworks configured | Report INFO: no frameworks active, skip review | | Compliance KP files missing | Warn and proceed with generic security review | | PR number invalid or inaccessible | Report error with PR number and suggest checking access |