Security & Auditing Skills

The self-review pipeline for this repository — the only one. Targets committed changes (default: everything since the merge-base with main), reviewing them through a multi-stage pipeline: deterministic checks (lint/typecheck/test/build/secret grep) → launch fresh-context reviewers (security-reviewer / spec-compliance-reviewer / adversarial-reviewer, plus security-diff-reviewer when the diff touches packages/git, packages/forge, or packages/adapter-) in parallel → reproduce-and-verify HIGH/CRITICAL findings with finding-validator. Can be invoked at any time, with or without a PR, and is what to run before pushing a fix to a security-sensitive package. If the working tree has uncommitted changes, use AskUserQuestion to confirm whether to include them. Zero side effects (no commit, push, or state writes), fail-open (this skill itself does not block the merge; it only reports findings). Invoked by "self-review this", "review this", or "/iroha-review". Not for reviewing a GitHub pull request — use /review for that; this reviews the local branch's diff and needs no PR.

Find out what the AI reviewer said about a pull request, and respond to it. The hosted OpenAI Codex reviewer is invisible to CI — it appears in no status check — so gh pr checks being green says nothing about whether a review ran, is still running, or left findings. Use after pushing to a PR and before reporting the work as done, when deciding whether a re-review is worth its rate limit, and when replying to or resolving a review thread. Not for reviewing a diff yourself — that is iroha-review.