Security Safety Review

This is a Hermes-native security-safety-review workflow skill.

Why This Exists

security-safety-review adapts ECC's AgentShield and safety-review posture into OMH as a review-first gate for agentic coding and operator workflows without adding hidden scanners or external dependencies, because an agent that runs commands and reads untrusted text can be steered into running them.

Do Not Use When

• The user asks for production readiness across release, rollback, and observability; use omh-production-audit.
• The user asks for merge verification commands; use omh-verification-gate.
• The user asks for a normal code review focused on bugs; use omh-code-review.
• The request is a vulnerability review of application code (injection, authorization, SSRF); use omh-code-review.
• The subject is an application or service rather than the agent's own runtime -- its assets, trust boundaries, attack scenarios, and the controls that defend them; use omh-application-threat-model.
• Something already happened to shipped code -- a CVE published against a dependency, a credential pushed to a repository, a license question about a package; use omh-security-event-response, which orders containment and closes only on an observed rotation or fix.

Examples