skills.rest
garethrhughes
garethrhughesCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

infosec

Audit staged changes for security, privacy, and compliance violations before merge.

5|1|Updated Apr 10, 2026
Search Tags:#access control#audit#compliance#encryption#security review#secrets#infosec
One-click install
npx skills add https://github.com/garethrhughes/fragile --skill infosec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: infosec
Source: https://github.com/garethrhughes/fragile/tree/main/.opencode/skills/infosec
Command: npx skills add https://github.com/garethrhughes/fragile --skill infosec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams review staged changes and pull requests for security, privacy, and compliance issues before merge, reducing the risk of shipping vulnerable or noncompliant code.

Core Features & Use Cases

  • Security and Compliance Review: Checks encryption, secrets handling, access control, audit logging, IAM, network exposure, dependency risk, and data retention against the project’s rules.
  • Verdict-Based Reporting: Returns an APPROVED, REQUIRES CHANGES, or APPROVED WITH EXCEPTION outcome with findings mapped to the relevant control.
  • Read-Only Audit Workflow: Evaluates code, infrastructure, and documentation without making edits, making it safe for final pre-merge review.
  • Use Case: Before merging a feature that touches auth, logging, or AWS infrastructure, use this Skill to confirm the change meets the repository’s security standards and to identify any required fixes.

Quick Start

Review the staged changes for security, privacy, and compliance risks and return the verdict in the Infosec review format.

Frequently Asked Questions about infosec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit staged changes for security and compliance violations before merge?▼

You can audit staged changes by running a read-only security review that checks code, infrastructure, and documentation for access control, secrets, encryption, and logging issues before merge.

What is a pre-merge security review and how does it work?▼

A pre-merge security review evaluates pull requests for privacy and compliance risks using read-only analysis, returning an APPROVED or REQUIRES CHANGES verdict with findings mapped to specific controls.

Can I check AWS infrastructure and IAM changes for compliance violations in pull requests?▼

Yes, you can check AWS infrastructure and IAM changes by analyzing staged pull request diffs for access control, network exposure, and audit logging configurations against your project's security standards.

How do I ensure secrets and encryption standards are met before shipping code?▼

Ensure secrets and encryption standards are met by running a pre-merge audit that evaluates dependency risks, secrets handling, and encryption configurations, returning concrete remediation guidance for any gaps.

Does this security review workflow modify code or infrastructure during the audit?▼

No, this security review workflow operates strictly as a read-only analysis, evaluating code and infrastructure without making edits, making it safe for final pre-merge compliance checks.

What's the best way to generate remediation guidance for security findings in a pull request?▼

The best way to generate remediation guidance is to use a verdict-based reporting system that maps each security and compliance finding to the relevant control with concrete fix instructions.

Related Skills

Explore More Legal & Compliance Skills→
dakshrawat298-gifdakshrawat298-gif

security-differential-review

Analyze code diffs for security vulnerabilities and categorize risks.

Community
Intermediate
seandkendallseandkendall
7

securing-s3-buckets

Audit and secure S3 buckets with encryption, logging, and access controls.

Community
Advanced
ysyecustysyecust
40

springboot-verification

Verify Spring Boot projects with builds, static analysis, tests, and security scans.

Community
Advanced
maxanatskomaxanatsko
255

mcp-engine-security-governance

Manage Power BI security policies and audit workflows with automated rules.

Community
Advanced