---
name: rba-security-review
description: >-
  Quick-entry slash command for the Security & Privacy Readiness Reviewer plugin.
  Routes to the appropriate skill based on arguments: 'owasp', 'cve', 'headers',
  'privacy', 'plan', 'summary', or 'all' for the full pipeline via the
  security-reviewer agent.
---

# /rba-security-review

Entry point for the RBA Security & Privacy Readiness Reviewer.

## Usage

```
/rba-security-review [scope] [target] [options]
```

## Scope Options

| Scope | Skill invoked | When to use |
|-------|--------------|-------------|
| `owasp <target>` | `owasp-security-audit` | Code review of file, directory, or git diff |
| `cve <target>` | `dependency-cve-scan` | Scan NuGet/npm dependencies for known CVEs |
| `headers <target>` | `security-headers-audit` | Review HTTP security headers in config or live URL |
| `privacy <target>` | `privacy-consent-review` | GDPR/CCPA consent and PII audit |
| `plan <findings>` | `security-remediation-plan` | Prioritise and sprint-plan existing findings |
| `summary <report>` | `security-client-summary` | Generate client-facing executive summary |
| `all <target>` | `security-reviewer` agent | Full pipeline: audit → CVE → headers → privacy → plan → summary |

## Examples

```
/rba-security-review owasp src/CustomerPortal
/rba-security-review owasp diff --platform sitecore
/rba-security-review cve .
/rba-security-review headers https://www.myproject.dev
/rba-security-review headers web.config --platform dotnet
/rba-security-review privacy . --regulation gdpr --platform umbraco
/rba-security-review plan security-findings.md
/rba-security-review summary security-findings.md
/rba-security-review all . --platform optimizely
```

## Routing Logic

Parse the first positional argument:

- `owasp` → invoke `owasp-security-audit` with remaining args
- `cve` → invoke `dependency-cve-scan` with remaining args
- `headers` → invoke `security-headers-audit` with remaining args
- `privacy` → invoke `privacy-consent-review` with remaining args
- `plan` → invoke `security-remediation-plan` with remaining args
- `summary` → invoke `security-client-summary` with remaining args
- `all` or no scope → invoke `security-reviewer` agent with remaining args

Pass `--platform` and `--regulation` flags through to the target skill unchanged.

## Options

| Option | Values | Default | Description |
|--------|--------|---------|-------------|
| `--platform` | `sitecore`, `optimizely`, `umbraco`, `headless`, `dotnet`, `nextjs` | auto-detect | Target platform adapter |
| `--regulation` | `gdpr`, `ccpa`, `both` | `both` | Privacy regulation scope (privacy scope only) |
| `--output` | `file`, `stdout` | `stdout` | Write report to file or print inline |