skills.rest
addxai
addxaiOFFICIAL
Explore all skills by this author →
GitHub

security-compliance-review

Detects secret leaks, PII exposure, and compliance violations in code, configuration, and documentation.

42|7|Updated Apr 17, 2026
Search Tags:#risk-assessment#code-review#access-control#secret-detection#security-review#compliance-review#pii-leakage
One-click install
npx skills add https://github.com/addxai/enterprise-harness-engineering --skill security-compliance-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-compliance-review
Source: https://github.com/addxai/enterprise-harness-engineering/tree/main/skills/security-compliance-review
Command: npx skills add https://github.com/addxai/enterprise-harness-engineering --skill security-compliance-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Manual security and compliance reviews for code, configuration, and documentation are inconsistent, time-consuming, and often miss critical enterprise risks like secret leaks, PII exposure, and access control gaps, leading to compliance violations and security incidents.

Core Features & Use Cases

  • Standardized Review Workflow: Follows a 3-step structured process (pre-gate system type check, relevance assessment, risk map check) for MR/PR reviews, architecture reviews, and periodic full repository scans.
  • Comprehensive Risk Detection: Automatically flags secrets exposure, PII leakage, third-party boundary violations, geolocation permission requests, and other compliance red lines.
  • Actionable Remediation Output: Generates a complete report with risk maps, gap lists, prioritized recommendations, and evidence references to accelerate issue resolution.
  • Use Case Example: A security team can use this skill to review a new feature that adds user data export functionality, automatically identifying missing export controls, unmasked PII fields, and hard-coded credentials.

Quick Start

Use the security-compliance-review skill to perform a full security and compliance review of the latest merge request in the user-authentication repository.

Frequently Asked Questions about security-compliance-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate security and compliance reviews for merge requests?▼

Automate merge request security reviews by following a structured 3-step process: pre-gate system type checks, relevance assessment, and risk map generation to detect secret leaks, PII exposure, and access control gaps.

What is the best way to detect PII leakage and hardcoded secrets in code?▼

Detect PII leakage and hardcoded secrets by performing structured reviews of code and configuration changes, automatically flagging compliance red lines and generating standardized risk maps with actionable remediation recommendations.

Can I use automated compliance checks for periodic full repository scans?▼

Automated compliance checks support periodic full repository scans for enterprise engineering and DevOps teams, applying company-standard security controls to identify third-party boundary violations and access control gaps across the codebase.

How does the review process handle missing system type and export capability definitions?▼

The review process blocks on critical missing clarifications like system type and export capability definitions during the pre-gate check, ensuring essential architecture context is established before proceeding to relevance and risk assessment.

What does a security review report include to help fix access control gaps?▼

A security review report includes risk maps, gap lists, prioritized recommendations, and evidence references to accelerate issue resolution for detected access control gaps and compliance violations.

When do I need a structured compliance review for new data export features?▼

You need a structured compliance review when adding user data export functionality to automatically identify missing export controls, unmasked PII fields, and hard-coded credentials before deployment.

Related Skills

Explore More Legal & Compliance Skills→
jcdendritejcdendrite
4

code-review

Review modified source files with principal-engineer checklists and diff-surface tripwires.

Community
Advanced
48Nauts-Operator48Nauts-Operator
3

threat-mitigation-mapping

Map identified threats to security controls and mitigation coverage gaps.

Community
Advanced
xlelibertyxleliberty

security-pen-testing

Perform offensive security assessments with vulnerability scanning and penetration testing.

Community
Advanced
eriknovakeriknovak

secrets

Scan git history and working trees for committed secrets and insecure secret practices.

Community
Intermediate