Security Safety Review

This is a Hermes-native security-safety-review workflow skill.

Why This Exists

security-safety-review adapts ECC's AgentShield and safety-review posture into OMH as a review-first gate for agentic coding and operator workflows without adding hidden scanners or external dependencies.

Do Not Use When

• The user asks for production readiness across release, rollback, and observability; use omh-production-audit.
• The user asks for merge verification commands; use omh-verification-gate.
• The user asks for a normal code review focused on bugs; use omh-code-review.
• The subject is an application or service rather than the agent's own runtime -- its assets, trust boundaries, attack scenarios, and the controls that defend them; use omh-application-threat-model.
• Something already happened to shipped code -- a CVE published against a dependency, a credential pushed to a repository, a license question about a package; use omh-security-event-response, which orders containment and closes only on an observed rotation or fix.

Examples

Good example: