What problem does it solve? Security reviews of repository changes often miss leaked secrets, over-privileged access, non-idempotent hardening scripts, and unverified claims that code was deployed, merged, or protected. This Skill provides a structured review workflow that catches these risks before they reach production. ## Core Features & Use Cases - Secret and Credential Detection: Blocks private keys, API keys, inline passwords, token assignments, and copied .env values before they enter the repository. - Least-Privilege and Hardening Review: Inspects users, tokens, GitHub workflow permissions, SSH access, firewall scope, and cloud service accounts, requiring idempotent and rollback-ready hardening scripts. - Validation Honesty Enforcement: Prevents unverified claims of pushed, merged, deployed, connected, ready, protected, or hardened states without direct evidence from commands, GitHub, or cloud providers. - Use Case: Before merging a PR that modifies SSH hardening scripts and GitHub workflows, run this review to confirm no secrets are committed, firewall rules are idempotent, rollback steps are documented, and branch protection claims are backed by actual GitHub state. ## Quick Start Use the seis-security-review skill to audit my current pull request for leaked secrets, least-privilege violations, and unverified deployment claims.
