# How to Set Up Security Review Workflows in ECC: A Complete Guide > Effortlessly set up security review workflows in ECC. Configure the security-review skill, enable the security-reviewer agent, and integrate automated scans to block vulnerabilities on every commit. - Repository: [Affaan Mustafa/ECC](https://github.com/affaan-m/ECC) - Tags: how-to-guide - Published: 2026-05-26 --- **You can set up security review workflows in ECC by configuring the `security-review` skill, enabling the `security-reviewer` agent in [`AGENTS.md`](https://github.com/affaan-m/ECC/blob/main/AGENTS.md), and integrating automated scans into your CI/CD pipeline via the `claw` CLI to block OWASP Top 10 vulnerabilities and hardcoded secrets on every commit.** ECC (Everything Claude Code) treats security as a first-class concern through its dedicated security review infrastructure. By combining the declarative `security-review` skill located in [`skills/security-review/SKILL.md`](https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md) with the automated `security-reviewer` agent defined in [`agents/security-reviewer.md`](https://github.com/affaan-m/ECC/blob/main/agents/security-reviewer.md), you can enforce continuous security gates that prevent critical vulnerabilities from reaching production. This guide explains how to configure these components according to the affaan-m/ECC source code to create an automated security workflow. ## Core Components of the ECC Security Architecture ECC security workflows rely on two primary components that work together: a skill that defines security standards and an agent that enforces them automatically. ### The Security-Review Skill The **security-review** skill serves as the authoritative source for security standards within your ECC project. Located at [`skills/security-review/SKILL.md`](https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md), this file enumerates concrete security checkpoints including secret management, input validation, SQL-injection prevention, Content-Security-Policy (CSP) configuration, and rate-limiting requirements. The skill provides both the checklist methodology and example implementations that the automated agent will enforce. ### The Security-Reviewer Agent The **security-reviewer** agent, defined in [`agents/security-reviewer.md`](https://github.com/affaan-m/ECC/blob/main/agents/security-reviewer.md), implements the automated scanner that executes the checklist from the security-review skill. According to the source code, this agent runs `npm audit`, `eslint-plugin-security` scans, searches for hard-coded secrets, and verifies OWASP Top 10 items. When invoked, it produces a JSON diagnostics report containing findings categorized by severity: `CRITICAL`, `HIGH`, `MEDIUM`, or `LOW`. ### Global Policy Configuration The [`AGENTS.md`](https://github.com/affaan-m/ECC/blob/main/AGENTS.md) file acts as the global policy document that declares when the `security-reviewer` must run. This file specifies that the agent executes on "security-sensitive code" and defines the failure policy, ensuring that no commit reaches the repository without a clean security check. ## Configuring the Security Review Workflow Setting up the workflow requires configuring the skill checklist and declaring the agent in your global policy. ### Step 1: Define Security Standards in SKILL.md First, customize the security checklist to match your project's requirements by editing [`skills/security-review/SKILL.md`](https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md). This file should enumerate specific patterns to detect, such as hardcoded API keys, missing CSP headers, or insecure authentication implementations. ### Step 2: Declare the Agent in AGENTS.md Update your [`AGENTS.md`](https://github.com/affaan-m/ECC/blob/main/AGENTS.md) file to include the `security-reviewer` agent in your project's agent registry. This declaration ensures that ECC recognizes the agent as the designated handler for security-sensitive changes and enforces its execution according to the policies defined in the global configuration. ## Integrating Security Reviews into CI/CD To enforce security gates automatically, integrate the `security-reviewer` agent into your continuous integration pipeline using the `claw` CLI. ### GitHub Actions Configuration Add the following step to your GitHub Actions workflow to run the security reviewer on every pull request and push to protected branches: ```yaml name: CI on: push: branches: [main, 'feature/*'] pull_request: jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install dependencies run: npm ci - name: Run security review run: npx claw security-reviewer env: NODE_ENV: test - name: Run tests run: npm test -- --coverage ``` The CI job parses the JSON report returned by the agent. If any finding is marked `CRITICAL` or `HIGH`, the job exits with a non-zero status, blocking the PR until issues are resolved. ## Orchestrating Multi-Agent Security Pipelines ECC allows you to chain the `security-reviewer` with other agents to create comprehensive development workflows. Use the `orchestrate` command to compose a pipeline that ensures security checks run after code review but before final approval. ### Complete Orchestration Example Run the following command to execute a full pipeline where security review occurs after code review but before architectural sign-off: ```bash claw orchestrate \ "planner,tdd-guide,code-reviewer,security-reviewer,architect" \ "[Plan: docs/plan/example-feature.md#step-2] Implement encrypted user sessions" ``` This orchestration ensures that every PR is examined for security regressions by the `security-reviewer` immediately after the `code-reviewer` completes its analysis, creating a mandatory security gate in your development process. ## Local Pre-Commit Hooks For immediate feedback during development, configure a local Git pre-commit hook that invokes the security-reviewer before allowing commits. ```bash #!/usr/bin/env bash # .git/hooks/pre-commit set -e echo "Running security review..." npx claw security-reviewer echo "Security check passed." ``` This script prevents commits from being created if the security check fails, allowing developers to fix issues before pushing to the remote repository. ## Understanding Security Reports The `security-reviewer` agent outputs structured JSON reports that your CI pipeline can parse to determine build status. ### Sample Report Structure ```json { "findings": [ { "id": "hardcoded-secret", "severity": "CRITICAL", "file": "src/auth.ts", "line": 27, "message": "Hardcoded API key detected" }, { "id": "missing-csp", "severity": "HIGH", "file": "next.config.js", "line": 18, "message": "Content‑Security‑Policy header not configured" } ], "summary": { "critical": 1, "high": 1, "medium": 0, "low": 0 } } ``` Configure your CI system to fail the build when `summary.critical` or `summary.high` values are greater than zero, ensuring that only code passing the security gate proceeds to deployment. ## Summary - **Configure the skill**: Edit [`skills/security-review/SKILL.md`](https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md) to define your project's specific security checkpoints and standards. - **Enable the agent**: Declare the `security-reviewer` in [`AGENTS.md`](https://github.com/affaan-m/ECC/blob/main/AGENTS.md) to enforce mandatory security scanning on sensitive code changes. - **Automate in CI**: Use `npx claw security-reviewer` in GitHub Actions to block builds containing `CRITICAL` or `HIGH` severity findings. - **Orchestrate workflows**: Chain the security-reviewer with other agents using `claw orchestrate` to ensure security gates run automatically in your development pipeline. - **Enforce locally**: Install Git pre-commit hooks to catch security issues before they reach the remote repository. ## Frequently Asked Questions ### What file defines the security checklist in ECC? The security checklist is defined in [`skills/security-review/SKILL.md`](https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md). This file contains the concrete security standards, code patterns, and validation rules that the `security-reviewer` agent enforces when scanning your codebase. ### How do I fail a build when the security-reviewer finds critical issues? The CI pipeline should parse the JSON report output by `npx claw security-reviewer` and check the `summary` object. If `critical` or `high` values are greater than zero, exit the job with a non-zero status code. This configuration blocks PR merges until the security gate passes. ### Can I run the security-reviewer agent locally before committing? Yes. Install a Git pre-commit hook in `.git/hooks/pre-commit` that executes `npx claw security-reviewer` with `set -e` to abort the commit if the agent returns any findings. This provides immediate feedback during development without waiting for CI results. ### Which security standards does the ECC security-reviewer check against? According to the source code in [`agents/security-reviewer.md`](https://github.com/affaan-m/ECC/blob/main/agents/security-reviewer.md), the agent checks against the **OWASP Top 10**, scans for hardcoded secrets, validates Content-Security-Policy headers, verifies rate-limiting implementations, runs `npm audit` for dependency vulnerabilities, and executes `eslint-plugin-security` for static analysis.