iv-cbv-payroll

Perform a comprehensive pre-commit security review on uncommitted changes. Covers all areas of the built-in /security-review, OWASP Top 10 (where applicable), and mandatorily detects secrets, PII, and PHI in staged changes. Use whenever a security review is requested, when running as a pre-commit hook, or any time uncommitted code changes need security validation before they enter the repository. Only report findings of low severity or above. Critical, high, and medium findings block the commit; low findings warn without blocking.

Perform a comprehensive security and IaC-compliance audit of an entire existing codebase, directory-by-directory. Unlike the pre-commit and PR review skills which review diffs, this skill reviews the full content of files at rest. Designed for one-time baseline audits, periodic full reviews (e.g., quarterly), audits before a compliance assessment, and audits of repositories being onboarded into a regulated environment. Produces one markdown report per directory batch in audit-reports/, optionally with SARIF output for ingestion into security dashboards. Supports min-severity filtering and resume mode for long-running audits.

Independent second-opinion adjudication of an automated first-pass security or compliance review. Given a first-pass findings report, re-inspect the cited code with fresh eyes and classify each finding as confirmed, false positive, or overstated (downgraded), with a one-line rationale each. Removes false positives before they reach the developer or report, without any manual suppression list. Invoked automatically by the dispatcher when a first pass reports findings; the gate is then decided by the adjudicated result.

Perform a comprehensive pre-commit IaC compliance review on uncommitted infrastructure-as-code changes (Terraform, CloudFormation, Bicep, Pulumi, Ansible, Kubernetes manifests, Helm charts, CDK, and similar). Checks staged changes against CMS ARS 5.1 and NIST SP 800-53 Rev 5 controls that are directly enforceable through IaC. Blocks on critical, high, and medium findings; warns on low. Use whenever an IaC compliance review is requested, when running as a pre-commit hook, or any time uncommitted infrastructure changes need compliance validation before they enter the repository. Only report findings of low severity or above.

Perform an AI-assisted pull-request review combining security (OWASP, secrets, PII, PHI) and IaC compliance (CMS ARS 5.1 / NIST SP 800-53 Rev 5) perspectives into a single unified review. Designed for use as a second layer of review after pre-commit hooks have already run on individual commits. Produces a human-readable terminal report and a machine-readable JSON structure that the dispatcher uses to post inline review comments on the PR via the GitHub API. Use this skill whenever a PR review is requested, when running as a GitHub Actions workflow on a pull_request event, or any time a developer wants an AI-assisted PR review without (or in addition to) GitHub Copilot PR review.