sparkfinderoven-r01-security-compliance-skills

🔒 Security & Compliance Skills Suite Skill by ara.so — Security Skills collection. This skill suite provides AI coding agents with expertise in security auditing, vulnerability management, compliance frameworks (GDPR/SOC2/ISO27001), and incident response. Derived from hesreallyhim/awesome-claude-code, it offers 10 specialized commands and 5 multi-step workflows with structured output. What This Project Does The r01-security-compliance-skills suite enables: - OWASP Top-10 vulnerability scanning with CVSS scoring and remediation guidance - Dependency CVE detection with exploitability analysis…

)\nif [ -n \"$CHANGED_FILES\" ]; then\n if ! claude-code /owasp-scan $CHANGED_FILES --fast; then\n echo \"❌ Security scan found critical issues\"\n exit 1\n fi\nfi\n\necho \"✅ Security checks passed\"\n```\n\n### Automated Compliance Reporting\n\n```python\n# scripts/weekly-compliance-report.py\nimport subprocess\nimport json\nfrom datetime import datetime\n\ndef run_compliance_scan():\n \"\"\"Run compliance audit and send report\"\"\"\n \n # Run GDPR audit\n gdpr_result = subprocess.run(\n [\"claude-code\", \"/gdpr-audit\", \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n \n # Run SOC 2 readiness\n soc2_result = subprocess.run(\n [\"claude-code\", \"/soc2-readiness\", \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n \n # Parse results\n gdpr_data = json.loads(gdpr_result.stdout)\n soc2_data = json.loads(soc2_result.stdout)\n \n # Generate summary\n report = f\"\"\"\n Compliance Report — {datetime.now().strftime('%Y-%m-%d')}\n \n GDPR Status: {gdpr_data['overall_compliance']}%\n Critical Gaps: {gdpr_data['critical_gaps_count']}\n \n SOC 2 Readiness: {soc2_data['overall_score']}%\n TSC Failures: {soc2_data['tsc_failures']}\n \n Action Required: {gdpr_data['critical_gaps_count'] + soc2_data['critical_gaps_count']} items\n \"\"\"\n \n # Send to Slack\n subprocess.run([\n \"curl\", \"-X\", \"POST\",\n \"-H\", \"Content-Type: application/json\",\n \"-d\", json.dumps({\"text\": report}),\n os.environ[\"SLACK_WEBHOOK_URL\"]\n ])\n\nif __name__ == \"__main__\":\n run_compliance_scan()\n```\n\n### Incident Response Automation\n\n```bash\n#!/bin/bash\n# scripts/incident-response.sh\n\nSEVERITY=$1\nINCIDENT_TYPE=$2\n\nif [ -z \"$SEVERITY\" ] || [ -z \"$INCIDENT_TYPE\" ]; then\n echo \"Usage: ./incident-response.sh \u003ccritical|high|medium> \u003cdata-breach|ransomware|ddos>\"\n exit 1\nfi\n\n# Create incident directory\nINCIDENT_ID=\"INC-$(date +%Y%m%d-%H%M%S)\"\nmkdir -p \"incidents/$INCIDENT_ID\"\n\n# Generate playbook\nclaude-code /incident-playbook \\\n --type \"$INCIDENT_TYPE\" \\\n --severity \"$SEVERITY\" \\\n --output \"incidents/$INCIDENT_ID/playbook.md\"\n\n# Run IAM audit\nclaude-code /iam-audit \\\n --output json > \"incidents/$INCIDENT_ID/iam-audit.json\"\n\n# Capture current state\necho \"Capturing system state...\"\nclaude-code /threat-model \\\n --current-state \\\n --output \"incidents/$INCIDENT_ID/current-threat-model.md\"\n\n# Create Jira ticket\nif [ -n \"$JIRA_API_TOKEN\" ]; then\n ISSUE_KEY=$(claude-code /integrations:jira:create-incident \\\n --incident-id \"$INCIDENT_ID\" \\\n --severity \"$SEVERITY\" \\\n --type \"$INCIDENT_TYPE\")\n echo \"Jira Issue Created: $ISSUE_KEY\"\nfi\n\n# Notify team\necho \"🚨 Security Incident: $INCIDENT_ID\" | \\\n claude-code /integrations:slack:notify \\\n --channel security-incidents \\\n --attach \"incidents/$INCIDENT_ID/playbook.md\"\n\necho \"Incident $INCIDENT_ID initialized. Follow playbook at incidents/$INCIDENT_ID/playbook.md\"\n```\n\n## Troubleshooting\n\n### Command Not Found\n\n```bash\n# Verify installation\nls -la ~/.claude/skills/\n\n# Reload skill in Claude Code session\n/read ~/.claude/skills/r01-hesreallyhim-awesome-claude-code-security/SKILL.md\n\n# Check Claude Code version (requires 0.8.0+)\nclaude-code --version\n```\n\n### False Positives in Scans\n\n```yaml\n# Create .security-ignore.yml in project root\nignore_patterns:\n - pattern: \"test/fixtures/**\"\n reason: \"Test data, not production code\"\n \n - pattern: \"docs/examples/**\"\n reason: \"Documentation examples\"\n \n - finding_id: \"OWASP-A03-SQL-001\"\n file: \"src/legacy/report-builder.js\"\n reason: \"Acknowledged risk - scheduled for refactor Q3\"\n expires: \"2024-09-30\"\n```\n\n### Integration Issues\n\n```bash\n# Test Jira connection\nclaude-code /integrations:test --service jira\n\n# Verify environment variables\nenv | grep -E '(JIRA|SLACK|GITHUB)'\n\n# Debug mode\nclaude-code /owasp-scan . --debug --verbose\n```\n\n### Performance Optimization\n\n```bash\n# For large codebases, use incremental scanning\nclaude-code /owasp-scan --incremental --cache-results\n\n# Parallel scanning\nclaude-code /dep-cve --parallel --workers 4\n\n# Exclude directories\nclaude-code /owasp-scan . --exclude node_modules,vendor,dist\n```\n\n### Custom Rule Not Triggering\n\n```yaml\n# Validate custom rule syntax\ncustom_rules:\n - id: custom-api-key\n name: \"Custom API Key Detection\"\n pattern: \"API_KEY_[A-Z0-9]{32}\" # Must be valid regex\n severity: high\n file_types: [\".js\", \".py\", \".env\"] # Limit to specific extensions\n enabled: true # Explicitly enable\n```\n\n```bash\n# Test custom rule\nclaude-code /secret-detect --test-rule custom-api-key --sample \"API_KEY_ABC123XYZ789012345678901234567\"\n```\n\n### Report Generation Failures\n\n```bash\n# Ensure output directory exists\nmkdir -p reports/\n\n# Check disk space\ndf -h\n\n# Use streaming output for large reports\nclaude-code /owasp-scan . --output json --stream > reports/scan-$(date +%Y%m%d).json\n\n# Compress old reports\nfind reports/ -name \"*.json\" -mtime +30 -exec gzip {} \\;\n```\n\n## Advanced Usage\n\n### Programmatic Access\n\n```python\n# Python wrapper for security-skills commands\nimport subprocess\nimport json\n\nclass SecuritySkills:\n def __init__(self, config_path=None):\n self.config = config_path\n \n def owasp_scan(self, target, severity=\"high\"):\n result = subprocess.run(\n [\"claude-code\", \"/owasp-scan\", target, \n \"--severity\", severity, \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n return json.loads(result.stdout)\n \n def dep_cve(self, scope=\"full\"):\n result = subprocess.run(\n [\"claude-code\", \"/dep-cve\", \n \"--scope\", scope, \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n return json.loads(result.stdout)\n \n def create_incident(self, incident_type, severity):\n result = subprocess.run(\n [\"claude-code\", \"/incident-playbook\",\n \"--type\", incident_type,\n \"--severity\", severity,\n \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n return json.loads(result.stdout)\n\n# Usage\nskills = SecuritySkills()\nscan_results = skills.owasp_scan(\"./src\", severity=\"critical\")\nif scan_results[\"critical_count\"] > 0:\n skills.create_incident(\"vulnerability-detected\", \"high\")\n```\n\n### Custom Workflow Orchestration\n\n```yaml\n# workflows/custom-audit.yml\nname: Custom Security Audit\ndescription: Organization-specific security workflow\n\nsteps:\n - name: Pre-audit Setup\n command: /iam-audit\n store_output: iam_results\n \n - name: Code Security\n parallel:\n - command: /owasp-scan\n args: [--target, ./src]\n - command: /dep-cve\n args: [--scope, full]\n - command: /secret-detect\n args: [--scan-history]\n \n - name: Compliance Check\n command: /gdpr-audit\n condition: ${iam_results.high_risk_count} > 0\n \n - name: Generate Report\n command: /pentest-report\n inputs:\n - ${STEP_1_OUTPUT}\n - ${STEP_2_OUTPUT}\n - ${STEP_3_OUTPUT}\n \n - name: Notify Team\n command: /integrations:slack:notify\n args:\n - --channel\n - security-team\n - --attach\n - ${STEP_4_OUTPUT}\n```\n\n```bash\n# Run custom workflow\nclaude-code /workflows:run workflows/custom-audit.yml\n```\n\n## Resources\n\n- **Source Project**: [hesreallyhim/awesome-claude-code](https://github.com/hesreallyhim/awesome-claude-code)\n- **Documentation**: Project README and command help (`/help \u003ccommand>`)\n- **Issue Tracker**: GitHub Issues for bug reports and feature requests\n- **Community**: Discussions tab for questions and best practices\n\n## License\n\nMIT License - Free to use, modify, and distribute.","attachment_filenames":[],"attachments":[],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"🔒 Security & Compliance Skills Suite","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"Skill by ","type":"text"},{"text":"ara.so","type":"text","marks":[{"type":"link","attrs":{"href":"https://ara.so","title":null}}]},{"text":" — Security Skills collection.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"This skill suite provides AI coding agents with expertise in security auditing, vulnerability management, compliance frameworks (GDPR/SOC2/ISO27001), and incident response. Derived from hesreallyhim/awesome-claude-code, it offers 10 specialized commands and 5 multi-step workflows with structured output.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"What This Project Does","type":"text"}]},{"type":"paragraph","content":[{"text":"The r01-security-compliance-skills suite enables:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"OWASP Top-10 vulnerability scanning","type":"text","marks":[{"type":"strong"}]},{"text":" with CVSS scoring and remediation guidance","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Dependency CVE detection","type":"text","marks":[{"type":"strong"}]},{"text":" with exploitability analysis and upgrade paths","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Compliance auditing","type":"text","marks":[{"type":"strong"}]},{"text":" for GDPR, SOC 2, ISO 27001 frameworks","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Threat modeling","type":"text","marks":[{"type":"strong"}]},{"text":" using STRIDE methodology","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"IAM least-privilege auditing","type":"text","marks":[{"type":"strong"}]},{"text":" for over-permissioned roles","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Secret detection","type":"text","marks":[{"type":"strong"}]},{"text":" with pre-commit hooks and entropy scanning","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Incident response playbooks","type":"text","marks":[{"type":"strong"}]},{"text":" for breach scenarios","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Installation","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Local Installation","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Clone to Claude Code skills directory\nmkdir -p ~/.claude/skills\ncd ~/.claude/skills\ngit clone https://github.com/sparkfinderoven/r01-hesreallyhim-awesome-claude-code-security.git\n\n# Or copy into existing skills directory\ncp -r /path/to/r01-security-compliance-skills ~/.claude/skills/","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Register with Claude Code","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# In a Claude Code session, load the skill:\n/read ~/.claude/skills/r01-hesreallyhim-awesome-claude-code-security/SKILL.md","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Verify Installation","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Check available commands\n/help security\n\n# Test with a simple scan\n/owasp-scan --target ./src --dry-run","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Core Commands","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/owasp-scan","type":"text","marks":[{"type":"code_inline"}]},{"text":" - OWASP Top-10 Code Scanning","type":"text"}]},{"type":"paragraph","content":[{"text":"Scans code for OWASP Top-10 vulnerabilities with exploit descriptions and CVSS scores.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Scan entire project\n/owasp-scan .\n\n# Scan specific directory with custom rules\n/owasp-scan ./api --rules owasp-top-10-2021 --severity high\n\n# Output JSON report\n/owasp-scan ./src --output json > security-report.json","type":"text"}]},{"type":"paragraph","content":[{"text":"Example Output Structure:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"OWASP Scan Results — ./api\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n✓ Files scanned: 47\n✓ Checks run: 14\n⚠ Findings: 3 critical, 5 high, 12 medium\n\nCRITICAL FINDINGS\n┌──────┬─────────────────────────────┬──────┬──────────────┐\n│ ID │ Issue │ CVSS │ Location │\n├──────┼─────────────────────────────┼──────┼──────────────┤\n│ A03 │ SQL Injection │ 9.8 │ api/search.js│\n│ A07 │ JWT None Algorithm Accepted │ 9.1 │ auth/jwt.js │\n└──────┴─────────────────────────────┴──────┴──────────────┘\n\nREMEDIATION (Critical Priority)\n• SQL Injection: Use parameterized queries\n - Replace: db.query(`SELECT * FROM users WHERE id=${id}`)\n - With: db.query('SELECT * FROM users WHERE id=?', [id])","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/dep-cve","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Dependency CVE Scanning","type":"text"}]},{"type":"paragraph","content":[{"text":"Analyzes dependencies for known CVEs with exploitability scores.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Scan package.json dependencies\n/dep-cve --file package.json\n\n# Full recursive scan with dev dependencies\n/dep-cve --scope full --include-dev\n\n# Check specific package\n/dep-cve --package [email protected]","type":"text"}]},{"type":"paragraph","content":[{"text":"Example Integration:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"javascript"},"content":[{"text":"// In package.json scripts\n{\n \"scripts\": {\n \"security:deps\": \"claude-code /dep-cve --scope full --output md > SECURITY.md\",\n \"precommit\": \"claude-code /dep-cve --severity critical --exit-code\"\n }\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/gdpr-audit","type":"text","marks":[{"type":"code_inline"}]},{"text":" - GDPR Compliance Auditing","type":"text"}]},{"type":"paragraph","content":[{"text":"Maps data flows, identifies consent gaps, and generates DPA checklists.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Full GDPR audit\n/gdpr-audit --scope full\n\n# Audit specific data category\n/gdpr-audit --category personal-data --output report\n\n# Check consent mechanisms\n/gdpr-audit --focus consent --include-cookies","type":"text"}]},{"type":"paragraph","content":[{"text":"Configuration File (","type":"text","marks":[{"type":"strong"}]},{"text":".gdpr-config.yml","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":"):","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"yaml"},"content":[{"text":"data_inventory:\n - category: personal_identifiable\n fields: [email, name, phone]\n storage: postgresql\n retention_days: 365\n legal_basis: consent\n \n - category: tracking\n fields: [ip_address, user_agent, session_id]\n storage: redis\n retention_days: 90\n legal_basis: legitimate_interest\n\nconsent_mechanisms:\n - type: cookie_banner\n granular: true\n documented: true\n \nprocessors:\n - name: AWS\n dpa_signed: true\n location: eu-west-1","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/soc2-readiness","type":"text","marks":[{"type":"code_inline"}]},{"text":" - SOC 2 Compliance Gap Analysis","type":"text"}]},{"type":"paragraph","content":[{"text":"Evaluates readiness across all 5 Trust Service Criteria (TSC).","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Full SOC 2 Type II assessment\n/soc2-readiness --type type2\n\n# Focus on specific criteria\n/soc2-readiness --criteria security,availability\n\n# Generate evidence requirements\n/soc2-readiness --output evidence-matrix","type":"text"}]},{"type":"paragraph","content":[{"text":"Example Report:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"SOC 2 Readiness Assessment\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nOverall Score: 67% (Needs Improvement)\n\nTRUST SERVICE CRITERIA\n┌────────────────┬────────┬──────┬────────────────┐\n│ Criteria │ Score │ Gaps │ Priority │\n├────────────────┼────────┼──────┼────────────────┤\n│ Security │ 78% │ 4 │ Medium │\n│ Availability │ 45% │ 9 │ 🔴 Critical │\n│ Processing │ 72% │ 3 │ Low │\n│ Confidentiality│ 89% │ 1 │ Low │\n│ Privacy │ 54% │ 7 │ High │\n└────────────────┴────────┴──────┴────────────────┘\n\nCRITICAL GAPS (Availability)\n• No documented disaster recovery plan\n• RTO/RPO not defined for production systems\n• Backup restoration not tested in last 90 days","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/threat-model","type":"text","marks":[{"type":"code_inline"}]},{"text":" - STRIDE Threat Modeling","type":"text"}]},{"type":"paragraph","content":[{"text":"Generates STRIDE-based threat models with risk matrices.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Create threat model from architecture diagram\n/threat-model --input architecture.png\n\n# Text-based architecture description\n/threat-model --architecture \"Web app → API Gateway → Lambda → RDS\"\n\n# Update existing model\n/threat-model --update ./docs/threat-model.md --new-component \"Redis Cache\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Example Threat Model:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"markdown"},"content":[{"text":"# Threat Model — Payment Processing System\n\n## Architecture\nUser → HTTPS → Load Balancer → API Server → PostgreSQL\n ↓\n Payment Gateway (Stripe)\n\n## STRIDE Analysis\n\n### Spoofing\n🔴 HIGH | User authentication bypass via JWT manipulation\n- Mitigation: Implement RS256 with key rotation\n- Status: Open\n\n### Tampering\n🟠 MEDIUM | SQL injection in payment history endpoint\n- Mitigation: Use parameterized queries + ORM\n- Status: In Review\n\n### Repudiation\n🟡 LOW | Insufficient audit logging on failed payments\n- Mitigation: Log all payment attempts with user context\n- Status: Planned\n\n### Information Disclosure\n🔴 HIGH | Credit card data in application logs\n- Mitigation: PCI-DSS compliant logging, tokenization\n- Status: Open\n\n### Denial of Service\n🟠 MEDIUM | No rate limiting on payment API\n- Mitigation: Implement rate limiting (10 req/min per user)\n- Status: In Progress\n\n### Elevation of Privilege\n🟡 LOW | Admin role has excessive database permissions\n- Mitigation: Principle of least privilege review\n- Status: Planned","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/secret-detect","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Secret Detection Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Configures pre-commit hooks for secret scanning with entropy analysis.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Initialize secret detection\n/secret-detect --init\n\n# Scan existing codebase\n/secret-detect --scan-history\n\n# Configure custom patterns\n/secret-detect --add-pattern \"CUSTOM_API_KEY_[A-Za-z0-9]{32}\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Generated Pre-commit Hook (","type":"text","marks":[{"type":"strong"}]},{"text":".git/hooks/pre-commit","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":"):","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"#!/bin/bash\n# Auto-generated by /secret-detect\n\necho \"Running secret detection...\"\n\n# High-entropy string detection\ngit diff --cached --name-only | xargs -I {} sh -c '\n if grep -E \"[A-Za-z0-9+/]{40,}\" {} > /dev/null 2>&1; then\n echo \"⚠️ High-entropy string detected in: {}\"\n echo \" This may be a secret. Review before committing.\"\n exit 1\n fi\n'\n\n# Known secret patterns\nPATTERNS=(\n \"AKIA[0-9A-Z]{16}\" # AWS Access Key\n \"sk_live_[0-9a-zA-Z]{24}\" # Stripe Live Key\n \"ghp_[0-9a-zA-Z]{36}\" # GitHub Personal Access Token\n \"xox[baprs]-[0-9a-zA-Z]{10,48}\" # Slack Token\n \"-----BEGIN (RSA|OPENSSH) PRIVATE KEY\" # Private Keys\n)\n\nfor pattern in \"${PATTERNS[@]}\"; do\n if git diff --cached | grep -E \"$pattern\" > /dev/null 2>&1; then\n echo \"🔴 SECRET DETECTED: Pattern '$pattern'\"\n echo \" Remove secret and use environment variables instead.\"\n exit 1\n fi\ndone\n\necho \"✓ No secrets detected\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/iam-audit","type":"text","marks":[{"type":"code_inline"}]},{"text":" - IAM Least-Privilege Auditing","type":"text"}]},{"type":"paragraph","content":[{"text":"Audits IAM roles for over-permissions, stale access, and MFA gaps.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Full IAM audit\n/iam-audit\n\n# Audit specific AWS account\n/iam-audit --provider aws --account-id 123456789012\n\n# Check for unused permissions\n/iam-audit --focus unused-permissions --days 90","type":"text"}]},{"type":"paragraph","content":[{"text":"Example Output:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"IAM Audit Results\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nOVER-PERMISSIONED ROLES\n┌────────────────┬──────────────┬────────────────┐\n│ Role │ Risk Level │ Issue │\n├────────────────┼──────────────┼────────────────┤\n│ dev-full-access│ 🔴 Critical │ Admin wildcard │\n│ lambda-exec │ 🟠 High │ s3:* on all │\n│ ec2-instance │ 🟡 Medium │ Unused RDS │\n└────────────────┴──────────────┴────────────────┘\n\nSTALE ACCESS (90+ days inactive)\n• [email protected] — Last login: 147 days ago\n• service-account-old — Last used: 203 days ago\n\nMFA GAPS\n• 3 admin users without MFA enabled\n• 12 privileged roles without MFA requirement\n\nRECOMMENDATIONS\n1. Replace dev-full-access with scoped policies\n2. Remove s3:* from lambda-exec, grant specific bucket access\n3. Deprovision stale accounts within 7 days\n4. Enforce MFA for all admin and privileged access","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/incident-playbook","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Security Incident Response","type":"text"}]},{"type":"paragraph","content":[{"text":"Generates structured incident response playbooks.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Create playbook for incident type\n/incident-playbook --type data-breach\n\n# Interactive incident response\n/incident-playbook --interactive --severity critical\n\n# Load existing incident\n/incident-playbook --load INC-2024-001","type":"text"}]},{"type":"paragraph","content":[{"text":"Example Playbook:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"markdown"},"content":[{"text":"# Security Incident Playbook — Data Breach\n\n## 1. TRIAGE (0-15 minutes)\n\n### Immediate Actions\n- [ ] Activate incident response team\n- [ ] Establish secure communication channel\n- [ ] Document initial discovery and scope\n- [ ] Assign incident commander\n\n### Initial Assessment\n- [ ] Identify affected systems\n- [ ] Estimate number of records exposed\n- [ ] Classify data sensitivity (PII, PCI, PHI, etc.)\n- [ ] Determine if breach is ongoing\n\n## 2. CONTAIN (15-60 minutes)\n\n### Stop Active Breach\n- [ ] Isolate compromised systems from network\n- [ ] Rotate all credentials with access to affected systems\n- [ ] Block suspicious IP addresses at firewall\n- [ ] Disable compromised user accounts\n\n### Preserve Evidence\n- [ ] Take disk snapshots of affected systems\n- [ ] Collect network logs and traffic captures\n- [ ] Document all actions with timestamps\n- [ ] Maintain chain of custody\n\n## 3. ERADICATE (1-4 hours)\n\n### Remove Threat\n- [ ] Identify root cause and attack vector\n- [ ] Patch exploited vulnerabilities\n- [ ] Remove malware/backdoors\n- [ ] Rebuild compromised systems from clean images\n\n### Verify Clean State\n- [ ] Run full security scans\n- [ ] Check for persistence mechanisms\n- [ ] Review user accounts for unauthorized access\n- [ ] Audit configuration changes\n\n## 4. RECOVER (4-24 hours)\n\n### Restore Operations\n- [ ] Bring systems back online in controlled manner\n- [ ] Monitor for signs of reinfection\n- [ ] Restore data from clean backups if needed\n- [ ] Update security controls based on lessons learned\n\n### Communication\n- [ ] Notify affected users within 72 hours (GDPR)\n- [ ] File breach notification with regulators\n- [ ] Coordinate with legal and PR teams\n- [ ] Prepare public statement if required\n\n## 5. LESSONS LEARNED (1-2 weeks post-incident)\n\n### Post-Mortem\n- [ ] Conduct blameless post-mortem\n- [ ] Document timeline and decisions\n- [ ] Identify preventive measures\n- [ ] Update incident response plan\n- [ ] Schedule security training\n\n### Metrics\n- Detection time: ___\n- Containment time: ___\n- Recovery time: ___\n- Records affected: ___\n- Estimated cost: ___","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/pentest-report","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Penetration Test Reporting","type":"text"}]},{"type":"paragraph","content":[{"text":"Structures penetration test findings into executive and technical reports.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Generate report from findings\n/pentest-report --input findings.json\n\n# Create executive summary\n/pentest-report --type executive --audience board\n\n# Technical deep-dive\n/pentest-report --type technical --include-exploits","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"/privacy-policy","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Privacy Policy Generator","type":"text"}]},{"type":"paragraph","content":[{"text":"Generates GDPR/CCPA-compliant privacy policies from data inventory.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Generate from data inventory\n/privacy-policy --input data-inventory.yml\n\n# Update existing policy\n/privacy-policy --update privacy.md --add-processor \"SendGrid\"\n\n# Multi-jurisdiction support\n/privacy-policy --jurisdictions eu,us-ca,uk","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Multi-Step Workflows","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"secure-sdlc","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Secure Software Development Lifecycle","type":"text"}]},{"type":"paragraph","content":[{"text":"End-to-end security workflow from threat modeling to sign-off.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Run full secure SDLC workflow\n/workflows:secure-sdlc --target ./my-app\n\n# Run specific stages\n/workflows:secure-sdlc --stages \"threat-model,code-scan\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Workflow Steps:","type":"text","marks":[{"type":"strong"}]}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Threat modeling (STRIDE analysis)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Static code analysis (OWASP scan)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Dependency vulnerability scan","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Dynamic application security testing (DAST)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Penetration testing","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Security sign-off checklist","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"breach-response","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Data Breach Response","type":"text"}]},{"type":"paragraph","content":[{"text":"Orchestrated breach response workflow.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Initiate breach response\n/workflows:breach-response --severity critical\n\n# Continue from checkpoint\n/workflows:breach-response --resume-from contain","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"compliance-audit","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Full Compliance Audit","type":"text"}]},{"type":"paragraph","content":[{"text":"Multi-framework compliance assessment.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Run compliance audit\n/workflows:compliance-audit --frameworks gdpr,soc2,iso27001\n\n# Specific scope\n/workflows:compliance-audit --scope \"user data processing\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"zero-trust-design","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Zero Trust Architecture","type":"text"}]},{"type":"paragraph","content":[{"text":"Designs zero-trust architecture across identity, network, workload, and data layers.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Design zero-trust architecture\n/workflows:zero-trust-design --current-architecture aws-vpc.yml","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"vendor-security","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Third-Party Security Assessment","type":"text"}]},{"type":"paragraph","content":[{"text":"Assesses vendor security posture with standardized questionnaire.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Assess new vendor\n/workflows:vendor-security --vendor \"Acme SaaS Inc\"\n\n# Automated risk scoring\n/workflows:vendor-security --questionnaire responses.json --auto-score","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuration","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Global Config (","type":"text"},{"text":".security-skills-config.yml","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"yaml"},"content":[{"text":"# Place in project root or ~/.config/security-skills/\n\n# Default severity thresholds\nseverity:\n block_on: critical\n warn_on: high\n report_all: true\n\n# Output preferences\noutput:\n format: table # table, json, markdown\n color: true\n verbose: false\n\n# Integration settings\nintegrations:\n jira:\n enabled: true\n url: ${JIRA_URL}\n api_token: ${JIRA_API_TOKEN}\n project_key: SEC\n \n slack:\n enabled: true\n webhook_url: ${SLACK_WEBHOOK_URL}\n channel: \"#security-alerts\"\n \n github:\n enabled: true\n token: ${GITHUB_TOKEN}\n create_issues: true\n\n# Custom rules\ncustom_rules:\n - id: custom-001\n name: \"Internal API Key Pattern\"\n pattern: \"INTERNAL_[A-Z0-9]{24}\"\n severity: high\n \n# Compliance frameworks\ncompliance:\n primary: gdpr\n secondary: [soc2, iso27001]\n audit_schedule: quarterly","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Environment Variables","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Required for integrations\nexport JIRA_URL=\"https://your-org.atlassian.net\"\nexport JIRA_API_TOKEN=\"your-token-here\"\nexport SLACK_WEBHOOK_URL=\"https://hooks.slack.com/services/xxx\"\nexport GITHUB_TOKEN=\"ghp_xxxxxxxxxxxx\"\n\n# Optional - provider-specific\nexport AWS_PROFILE=\"security-audit\"\nexport AZURE_SUBSCRIPTION_ID=\"xxxxx\"\nexport GCP_PROJECT_ID=\"your-project\"","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Common Patterns","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"CI/CD Integration","type":"text"}]},{"type":"paragraph","content":[{"text":"GitHub Actions (","type":"text","marks":[{"type":"strong"}]},{"text":".github/workflows/security.yml","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":"):","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"yaml"},"content":[{"text":"name: Security Checks\n\non: [push, pull_request]\n\njobs:\n security-scan:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v3\n \n - name: Install Security Skills\n run: |\n mkdir -p ~/.claude/skills\n cp -r ./.security-skills ~/.claude/skills/\n \n - name: OWASP Scan\n run: |\n claude-code /owasp-scan . --output json > owasp-report.json\n \n - name: Dependency CVE Scan\n run: |\n claude-code /dep-cve --scope full --severity critical --exit-code\n \n - name: Secret Detection\n run: |\n claude-code /secret-detect --scan-history\n \n - name: Upload Reports\n uses: actions/upload-artifact@v3\n with:\n name: security-reports\n path: |\n owasp-report.json\n SECURITY.md","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pre-commit Hook Integration","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# .git/hooks/pre-commit\n#!/bin/bash\n\necho \"🔒 Running security checks...\"\n\n# Secret detection\nif ! claude-code /secret-detect --staged-only; then\n echo \"❌ Secret detection failed\"\n exit 1\nfi\n\n# Quick OWASP scan on changed files\nCHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\\.(js|py|java|go)

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

)\nif [ -n \"$CHANGED_FILES\" ]; then\n if ! claude-code /owasp-scan $CHANGED_FILES --fast; then\n echo \"❌ Security scan found critical issues\"\n exit 1\n fi\nfi\n\necho \"✅ Security checks passed\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Automated Compliance Reporting","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# scripts/weekly-compliance-report.py\nimport subprocess\nimport json\nfrom datetime import datetime\n\ndef run_compliance_scan():\n \"\"\"Run compliance audit and send report\"\"\"\n \n # Run GDPR audit\n gdpr_result = subprocess.run(\n [\"claude-code\", \"/gdpr-audit\", \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n \n # Run SOC 2 readiness\n soc2_result = subprocess.run(\n [\"claude-code\", \"/soc2-readiness\", \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n \n # Parse results\n gdpr_data = json.loads(gdpr_result.stdout)\n soc2_data = json.loads(soc2_result.stdout)\n \n # Generate summary\n report = f\"\"\"\n Compliance Report — {datetime.now().strftime('%Y-%m-%d')}\n \n GDPR Status: {gdpr_data['overall_compliance']}%\n Critical Gaps: {gdpr_data['critical_gaps_count']}\n \n SOC 2 Readiness: {soc2_data['overall_score']}%\n TSC Failures: {soc2_data['tsc_failures']}\n \n Action Required: {gdpr_data['critical_gaps_count'] + soc2_data['critical_gaps_count']} items\n \"\"\"\n \n # Send to Slack\n subprocess.run([\n \"curl\", \"-X\", \"POST\",\n \"-H\", \"Content-Type: application/json\",\n \"-d\", json.dumps({\"text\": report}),\n os.environ[\"SLACK_WEBHOOK_URL\"]\n ])\n\nif __name__ == \"__main__\":\n run_compliance_scan()","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Incident Response Automation","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"#!/bin/bash\n# scripts/incident-response.sh\n\nSEVERITY=$1\nINCIDENT_TYPE=$2\n\nif [ -z \"$SEVERITY\" ] || [ -z \"$INCIDENT_TYPE\" ]; then\n echo \"Usage: ./incident-response.sh \u003ccritical|high|medium> \u003cdata-breach|ransomware|ddos>\"\n exit 1\nfi\n\n# Create incident directory\nINCIDENT_ID=\"INC-$(date +%Y%m%d-%H%M%S)\"\nmkdir -p \"incidents/$INCIDENT_ID\"\n\n# Generate playbook\nclaude-code /incident-playbook \\\n --type \"$INCIDENT_TYPE\" \\\n --severity \"$SEVERITY\" \\\n --output \"incidents/$INCIDENT_ID/playbook.md\"\n\n# Run IAM audit\nclaude-code /iam-audit \\\n --output json > \"incidents/$INCIDENT_ID/iam-audit.json\"\n\n# Capture current state\necho \"Capturing system state...\"\nclaude-code /threat-model \\\n --current-state \\\n --output \"incidents/$INCIDENT_ID/current-threat-model.md\"\n\n# Create Jira ticket\nif [ -n \"$JIRA_API_TOKEN\" ]; then\n ISSUE_KEY=$(claude-code /integrations:jira:create-incident \\\n --incident-id \"$INCIDENT_ID\" \\\n --severity \"$SEVERITY\" \\\n --type \"$INCIDENT_TYPE\")\n echo \"Jira Issue Created: $ISSUE_KEY\"\nfi\n\n# Notify team\necho \"🚨 Security Incident: $INCIDENT_ID\" | \\\n claude-code /integrations:slack:notify \\\n --channel security-incidents \\\n --attach \"incidents/$INCIDENT_ID/playbook.md\"\n\necho \"Incident $INCIDENT_ID initialized. Follow playbook at incidents/$INCIDENT_ID/playbook.md\"","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Troubleshooting","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Command Not Found","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Verify installation\nls -la ~/.claude/skills/\n\n# Reload skill in Claude Code session\n/read ~/.claude/skills/r01-hesreallyhim-awesome-claude-code-security/SKILL.md\n\n# Check Claude Code version (requires 0.8.0+)\nclaude-code --version","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"False Positives in Scans","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"yaml"},"content":[{"text":"# Create .security-ignore.yml in project root\nignore_patterns:\n - pattern: \"test/fixtures/**\"\n reason: \"Test data, not production code\"\n \n - pattern: \"docs/examples/**\"\n reason: \"Documentation examples\"\n \n - finding_id: \"OWASP-A03-SQL-001\"\n file: \"src/legacy/report-builder.js\"\n reason: \"Acknowledged risk - scheduled for refactor Q3\"\n expires: \"2024-09-30\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Integration Issues","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Test Jira connection\nclaude-code /integrations:test --service jira\n\n# Verify environment variables\nenv | grep -E '(JIRA|SLACK|GITHUB)'\n\n# Debug mode\nclaude-code /owasp-scan . --debug --verbose","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Performance Optimization","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# For large codebases, use incremental scanning\nclaude-code /owasp-scan --incremental --cache-results\n\n# Parallel scanning\nclaude-code /dep-cve --parallel --workers 4\n\n# Exclude directories\nclaude-code /owasp-scan . --exclude node_modules,vendor,dist","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Custom Rule Not Triggering","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"yaml"},"content":[{"text":"# Validate custom rule syntax\ncustom_rules:\n - id: custom-api-key\n name: \"Custom API Key Detection\"\n pattern: \"API_KEY_[A-Z0-9]{32}\" # Must be valid regex\n severity: high\n file_types: [\".js\", \".py\", \".env\"] # Limit to specific extensions\n enabled: true # Explicitly enable","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Test custom rule\nclaude-code /secret-detect --test-rule custom-api-key --sample \"API_KEY_ABC123XYZ789012345678901234567\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Report Generation Failures","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Ensure output directory exists\nmkdir -p reports/\n\n# Check disk space\ndf -h\n\n# Use streaming output for large reports\nclaude-code /owasp-scan . --output json --stream > reports/scan-$(date +%Y%m%d).json\n\n# Compress old reports\nfind reports/ -name \"*.json\" -mtime +30 -exec gzip {} \\;","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Advanced Usage","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Programmatic Access","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# Python wrapper for security-skills commands\nimport subprocess\nimport json\n\nclass SecuritySkills:\n def __init__(self, config_path=None):\n self.config = config_path\n \n def owasp_scan(self, target, severity=\"high\"):\n result = subprocess.run(\n [\"claude-code\", \"/owasp-scan\", target, \n \"--severity\", severity, \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n return json.loads(result.stdout)\n \n def dep_cve(self, scope=\"full\"):\n result = subprocess.run(\n [\"claude-code\", \"/dep-cve\", \n \"--scope\", scope, \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n return json.loads(result.stdout)\n \n def create_incident(self, incident_type, severity):\n result = subprocess.run(\n [\"claude-code\", \"/incident-playbook\",\n \"--type\", incident_type,\n \"--severity\", severity,\n \"--output\", \"json\"],\n capture_output=True,\n text=True\n )\n return json.loads(result.stdout)\n\n# Usage\nskills = SecuritySkills()\nscan_results = skills.owasp_scan(\"./src\", severity=\"critical\")\nif scan_results[\"critical_count\"] > 0:\n skills.create_incident(\"vulnerability-detected\", \"high\")","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Custom Workflow Orchestration","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"yaml"},"content":[{"text":"# workflows/custom-audit.yml\nname: Custom Security Audit\ndescription: Organization-specific security workflow\n\nsteps:\n - name: Pre-audit Setup\n command: /iam-audit\n store_output: iam_results\n \n - name: Code Security\n parallel:\n - command: /owasp-scan\n args: [--target, ./src]\n - command: /dep-cve\n args: [--scope, full]\n - command: /secret-detect\n args: [--scan-history]\n \n - name: Compliance Check\n command: /gdpr-audit\n condition: ${iam_results.high_risk_count} > 0\n \n - name: Generate Report\n command: /pentest-report\n inputs:\n - ${STEP_1_OUTPUT}\n - ${STEP_2_OUTPUT}\n - ${STEP_3_OUTPUT}\n \n - name: Notify Team\n command: /integrations:slack:notify\n args:\n - --channel\n - security-team\n - --attach\n - ${STEP_4_OUTPUT}","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Run custom workflow\nclaude-code /workflows:run workflows/custom-audit.yml","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Resources","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Source Project","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"hesreallyhim/awesome-claude-code","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/hesreallyhim/awesome-claude-code","title":null}}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Documentation","type":"text","marks":[{"type":"strong"}]},{"text":": Project README and command help (","type":"text"},{"text":"/help \u003ccommand>","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Issue Tracker","type":"text","marks":[{"type":"strong"}]},{"text":": GitHub Issues for bug reports and feature requests","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Community","type":"text","marks":[{"type":"strong"}]},{"text":": Discussions tab for questions and best practices","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"License","type":"text"}]},{"type":"paragraph","content":[{"text":"MIT License - Free to use, modify, and distribute.","type":"text"}]}]},"metadata":{"date":"2026-11-02","name":"sparkfinderoven-r01-security-compliance-skills","author":"@skillopedia","source":{"stars":12,"repo_name":"security-skills","origin_url":"https://github.com/reason-machines/security-skills/blob/HEAD/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md","repo_owner":"reason-machines","body_sha256":"69e5642281c8f229b39935fc3aa7621e8aa970d29df51d0c6e3d14991cc9c5c6","cluster_key":"0f3f67567a1befa4fff9bfcb524b9dae1871218b6dee1604fc1ed2477de92345","clean_bundle":{"format":"clean-skill-bundle-v1","source":"reason-machines/security-skills/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md","text_bytes":0,"source_commit":"1722e18788818fff1b0144132437936c2095971c","skills_sh_rank":15931,"attachment_count":0,"text_attachments":0,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","triggers":["scan my code for OWASP vulnerabilities","check dependencies for CVEs","audit our application for GDPR compliance","create a threat model for this architecture","generate a SOC 2 readiness report","detect secrets in the codebase","run a security audit on this project","help me respond to a security incident"],"import_tag":"skills-sh-top20k-2026-11","description":"Security & compliance skill suite for OWASP scanning, CVE detection, GDPR/SOC2 audits, threat modeling, and incident response workflows"}},"renderedAt":1793672058915}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.