From grc-engineer
Reviews GitHub/GitLab pull requests for compliance regressions like SOC 2, ISO 27001, NIST 800-53. Scans code diffs for security violations in IAM, encryption, networking and suggests fixes.
How this skill is triggered — by the user, by Claude, or both
Slash command
/grc-engineer:audit-ready-pr-reviewerThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Reviews GitHub/GitLab pull requests specifically for compliance regressions. Shifts compliance "left" into the developer's daily workflow.
Reviews GitHub/GitLab pull requests specifically for compliance regressions. Shifts compliance "left" into the developer's daily workflow.
Review a PR for SOC 2 compliance:
node scripts/review-pr.js myorg/infrastructure 42 SOC2
Review a PR for ISO 27001:
node scripts/review-pr.js myorg/infrastructure 42 ISO27001
Review a PR with custom framework:
node scripts/review-pr.js myorg/infrastructure 42 NIST80053
Posts GitHub comments with:
⚠️ **Compliance Warning: SOC 2 CC6.1 - Least Privilege**
This PR introduces an IAM role with `AdministratorAccess`, which violates the Least Privilege principle.
**Issue:** Line 23 in `terraform/iam.tf` assigns full administrative access.
**Suggested Fix:**
```hcl
resource "aws_iam_role" "app_role" {
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Action = [
"s3:GetObject",
"s3:PutObject"
]
Resource = "arn:aws:s3:::my-bucket/*"
}]
})
}
Control Reference: SOC 2 CC6.1, NIST 800-53 AC-6
## Prerequisites
- GitHub repository (owner/repo format)
- PR number
- `GITHUB_TOKEN` environment variable (requires `repo` scope)
- Optional: Framework name (defaults to SOC2)
npx claudepluginhub grcengclub/claude-grc-engineering --plugin grc-engineerEvaluates GitHub repos for compliance using github-inspector checks on branch protection, secret scanning, Dependabot alerts, and code scanning; maps to SCF controls and interprets gh CLI output.
Reviews pull requests with multi-layered static analysis (CodeQL, SonarQube, Semgrep) and AI-assisted contextual checks for security, performance, and architecture issues across 30+ languages.
Performs graph-powered PR reviews with quality audits, test coverage checks, framework validation, and security analysis using verified code graph findings.