How to Set Up Security Review Workflows in ECC: A Complete Guide

You can set up security review workflows in ECC by configuring the security-review skill, enabling the security-reviewer agent in AGENTS.md, and integrating automated scans into your CI/CD pipeline via the claw CLI to block OWASP Top 10 vulnerabilities and hardcoded secrets on every commit.

ECC (Everything Claude Code) treats security as a first-class concern through its dedicated security review infrastructure. By combining the declarative security-review skill located in skills/security-review/SKILL.md with the automated security-reviewer agent defined in agents/security-reviewer.md, you can enforce continuous security gates that prevent critical vulnerabilities from reaching production. This guide explains how to configure these components according to the affaan-m/ECC source code to create an automated security workflow.

Core Components of the ECC Security Architecture

ECC security workflows rely on two primary components that work together: a skill that defines security standards and an agent that enforces them automatically.

The Security-Review Skill

The security-review skill serves as the authoritative source for security standards within your ECC project. Located at skills/security-review/SKILL.md, this file enumerates concrete security checkpoints including secret management, input validation, SQL-injection prevention, Content-Security-Policy (CSP) configuration, and rate-limiting requirements. The skill provides both the checklist methodology and example implementations that the automated agent will enforce.

The Security-Reviewer Agent

The security-reviewer agent, defined in agents/security-reviewer.md, implements the automated scanner that executes the checklist from the security-review skill. According to the source code, this agent runs npm audit, eslint-plugin-security scans, searches for hard-coded secrets, and verifies OWASP Top 10 items. When invoked, it produces a JSON diagnostics report containing findings categorized by severity: CRITICAL, HIGH, MEDIUM, or LOW.

Global Policy Configuration

The AGENTS.md file acts as the global policy document that declares when the security-reviewer must run. This file specifies that the agent executes on "security-sensitive code" and defines the failure policy, ensuring that no commit reaches the repository without a clean security check.

Configuring the Security Review Workflow

Setting up the workflow requires configuring the skill checklist and declaring the agent in your global policy.

Step 1: Define Security Standards in SKILL.md

First, customize the security checklist to match your project's requirements by editing skills/security-review/SKILL.md. This file should enumerate specific patterns to detect, such as hardcoded API keys, missing CSP headers, or insecure authentication implementations.

Step 2: Declare the Agent in AGENTS.md

Update your AGENTS.md file to include the security-reviewer agent in your project's agent registry. This declaration ensures that ECC recognizes the agent as the designated handler for security-sensitive changes and enforces its execution according to the policies defined in the global configuration.

Integrating Security Reviews into CI/CD

To enforce security gates automatically, integrate the security-reviewer agent into your continuous integration pipeline using the claw CLI.

GitHub Actions Configuration

Add the following step to your GitHub Actions workflow to run the security reviewer on every pull request and push to protected branches:

name: CI

on:
  push:
    branches: [main, 'feature/*']
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: npm ci
      - name: Run security review
        run: npx claw security-reviewer
        env:
          NODE_ENV: test
      - name: Run tests
        run: npm test -- --coverage

The CI job parses the JSON report returned by the agent. If any finding is marked CRITICAL or HIGH, the job exits with a non-zero status, blocking the PR until issues are resolved.

Orchestrating Multi-Agent Security Pipelines

ECC allows you to chain the security-reviewer with other agents to create comprehensive development workflows. Use the orchestrate command to compose a pipeline that ensures security checks run after code review but before final approval.

Complete Orchestration Example

Run the following command to execute a full pipeline where security review occurs after code review but before architectural sign-off:

claw orchestrate \
  "planner,tdd-guide,code-reviewer,security-reviewer,architect" \
  "[Plan: docs/plan/example-feature.md#step-2] Implement encrypted user sessions"

This orchestration ensures that every PR is examined for security regressions by the security-reviewer immediately after the code-reviewer completes its analysis, creating a mandatory security gate in your development process.

Local Pre-Commit Hooks

For immediate feedback during development, configure a local Git pre-commit hook that invokes the security-reviewer before allowing commits.

#!/usr/bin/env bash

# .git/hooks/pre-commit

set -e
echo "Running security review..."
npx claw security-reviewer
echo "Security check passed."

This script prevents commits from being created if the security check fails, allowing developers to fix issues before pushing to the remote repository.

Understanding Security Reports

The security-reviewer agent outputs structured JSON reports that your CI pipeline can parse to determine build status.

Sample Report Structure

{
  "findings": [
    {
      "id": "hardcoded-secret",
      "severity": "CRITICAL",
      "file": "src/auth.ts",
      "line": 27,
      "message": "Hardcoded API key detected"
    },
    {
      "id": "missing-csp",
      "severity": "HIGH",
      "file": "next.config.js",
      "line": 18,
      "message": "Content‑Security‑Policy header not configured"
    }
  ],
  "summary": {
    "critical": 1,
    "high": 1,
    "medium": 0,
    "low": 0
  }
}

Configure your CI system to fail the build when summary.critical or summary.high values are greater than zero, ensuring that only code passing the security gate proceeds to deployment.

Summary

• Configure the skill: Edit skills/security-review/SKILL.md to define your project's specific security checkpoints and standards.
• Enable the agent: Declare the security-reviewer in AGENTS.md to enforce mandatory security scanning on sensitive code changes.
• Automate in CI: Use npx claw security-reviewer in GitHub Actions to block builds containing CRITICAL or HIGH severity findings.
• Orchestrate workflows: Chain the security-reviewer with other agents using claw orchestrate to ensure security gates run automatically in your development pipeline.
• Enforce locally: Install Git pre-commit hooks to catch security issues before they reach the remote repository.

Frequently Asked Questions

What file defines the security checklist in ECC?

The security checklist is defined in skills/security-review/SKILL.md. This file contains the concrete security standards, code patterns, and validation rules that the security-reviewer agent enforces when scanning your codebase.

How do I fail a build when the security-reviewer finds critical issues?

The CI pipeline should parse the JSON report output by npx claw security-reviewer and check the summary object. If critical or high values are greater than zero, exit the job with a non-zero status code. This configuration blocks PR merges until the security gate passes.

Can I run the security-reviewer agent locally before committing?

Yes. Install a Git pre-commit hook in .git/hooks/pre-commit that executes npx claw security-reviewer with set -e to abort the commit if the agent returns any findings. This provides immediate feedback during development without waiting for CI results.

Which security standards does the ECC security-reviewer check against?

According to the source code in agents/security-reviewer.md, the agent checks against the OWASP Top 10, scans for hardcoded secrets, validates Content-Security-Policy headers, verifies rate-limiting implementations, runs npm audit for dependency vulnerabilities, and executes eslint-plugin-security for static analysis.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}