Sparkfinderoven R01 Security Compliance Skills

🔒 Security & Compliance Skills Suite

Skill by ara.so — Security Skills collection.

This skill suite provides AI coding agents with expertise in security auditing, vulnerability management, compliance frameworks (GDPR/SOC2/ISO27001), and incident response. Derived from hesreallyhim/awesome-claude-code, it offers 10 specialized commands and 5 multi-step workflows with structured output.

What This Project Does

The r01-security-compliance-skills suite enables:

• OWASP Top-10 vulnerability scanning with CVSS scoring and remediation guidance
• Dependency CVE detection with exploitability analysis and upgrade paths
• Compliance auditing for GDPR, SOC 2, ISO 27001 frameworks
• Threat modeling using STRIDE methodology
• IAM least-privilege auditing for over-permissioned roles
• Secret detection with pre-commit hooks and entropy scanning
• Incident response playbooks for breach scenarios

Installation

Local Installation

# Clone to Claude Code skills directory
mkdir -p ~/.claude/skills
cd ~/.claude/skills
git clone https://github.com/sparkfinderoven/r01-hesreallyhim-awesome-claude-code-security.git

# Or copy into existing skills directory
cp -r /path/to/r01-security-compliance-skills ~/.claude/skills/

Register with Claude Code

# In a Claude Code session, load the skill:
/read ~/.claude/skills/r01-hesreallyhim-awesome-claude-code-security/SKILL.md

Verify Installation

# Check available commands
/help security

# Test with a simple scan
/owasp-scan --target ./src --dry-run

Core Commands

/owasp-scan - OWASP Top-10 Code Scanning

Scans code for OWASP Top-10 vulnerabilities with exploit descriptions and CVSS scores.

# Scan entire project
/owasp-scan .

# Scan specific directory with custom rules
/owasp-scan ./api --rules owasp-top-10-2021 --severity high

# Output JSON report
/owasp-scan ./src --output json > security-report.json

Example Output Structure:

OWASP Scan Results — ./api
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✓ Files scanned: 47
✓ Checks run: 14
⚠ Findings: 3 critical, 5 high, 12 medium

CRITICAL FINDINGS
┌──────┬─────────────────────────────┬──────┬──────────────┐
│ ID   │ Issue                       │ CVSS │ Location     │
├──────┼─────────────────────────────┼──────┼──────────────┤
│ A03  │ SQL Injection               │ 9.8  │ api/search.js│
│ A07  │ JWT None Algorithm Accepted │ 9.1  │ auth/jwt.js  │
└──────┴─────────────────────────────┴──────┴──────────────┘

REMEDIATION (Critical Priority)
• SQL Injection: Use parameterized queries
  - Replace: db.query(`SELECT * FROM users WHERE id=${id}`)
  - With: db.query('SELECT * FROM users WHERE id=?', [id])

/dep-cve - Dependency CVE Scanning

Analyzes dependencies for known CVEs with exploitability scores.

# Scan package.json dependencies
/dep-cve --file package.json

# Full recursive scan with dev dependencies
/dep-cve --scope full --include-dev

# Check specific package
/dep-cve --package express@4.17.1

Example Integration:

// In package.json scripts
{
  "scripts": {
    "security:deps": "claude-code /dep-cve --scope full --output md > SECURITY.md",
    "precommit": "claude-code /dep-cve --severity critical --exit-code"
  }
}

/gdpr-audit - GDPR Compliance Auditing

Maps data flows, identifies consent gaps, and generates DPA checklists.

# Full GDPR audit
/gdpr-audit --scope full

# Audit specific data category
/gdpr-audit --category personal-data --output report

# Check consent mechanisms
/gdpr-audit --focus consent --include-cookies

Configuration File (`.gdpr-config.yml`):

data_inventory:
  - category: personal_identifiable
    fields: [email, name, phone]
    storage: postgresql
    retention_days: 365
    legal_basis: consent
  
  - category: tracking
    fields: [ip_address, user_agent, session_id]
    storage: redis
    retention_days: 90
    legal_basis: legitimate_interest

consent_mechanisms:
  - type: cookie_banner
    granular: true
    documented: true
  
processors:
  - name: AWS
    dpa_signed: true
    location: eu-west-1

/soc2-readiness - SOC 2 Compliance Gap Analysis

Evaluates readiness across all 5 Trust Service Criteria (TSC).

# Full SOC 2 Type II assessment
/soc2-readiness --type type2

# Focus on specific criteria
/soc2-readiness --criteria security,availability

# Generate evidence requirements
/soc2-readiness --output evidence-matrix

Example Report:

SOC 2 Readiness Assessment
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Overall Score: 67% (Needs Improvement)

TRUST SERVICE CRITERIA
┌────────────────┬────────┬──────┬────────────────┐
│ Criteria       │ Score  │ Gaps │ Priority       │
├────────────────┼────────┼──────┼────────────────┤
│ Security       │ 78%    │  4   │ Medium         │
│ Availability   │ 45%    │  9   │ 🔴 Critical    │
│ Processing     │ 72%    │  3   │ Low            │
│ Confidentiality│ 89%    │  1   │ Low            │
│ Privacy        │ 54%    │  7   │ High           │
└────────────────┴────────┴──────┴────────────────┘

CRITICAL GAPS (Availability)
• No documented disaster recovery plan
• RTO/RPO not defined for production systems
• Backup restoration not tested in last 90 days

/threat-model - STRIDE Threat Modeling

Generates STRIDE-based threat models with risk matrices.

# Create threat model from architecture diagram
/threat-model --input architecture.png

# Text-based architecture description
/threat-model --architecture "Web app → API Gateway → Lambda → RDS"

# Update existing model
/threat-model --update ./docs/threat-model.md --new-component "Redis Cache"

Example Threat Model:

# Threat Model — Payment Processing System

## Architecture
User → HTTPS → Load Balancer → API Server → PostgreSQL
                                    ↓
                               Payment Gateway (Stripe)

## STRIDE Analysis

### Spoofing
🔴 HIGH | User authentication bypass via JWT manipulation
- Mitigation: Implement RS256 with key rotation
- Status: Open

### Tampering
🟠 MEDIUM | SQL injection in payment history endpoint
- Mitigation: Use parameterized queries + ORM
- Status: In Review

### Repudiation
🟡 LOW | Insufficient audit logging on failed payments
- Mitigation: Log all payment attempts with user context
- Status: Planned

### Information Disclosure
🔴 HIGH | Credit card data in application logs
- Mitigation: PCI-DSS compliant logging, tokenization
- Status: Open

### Denial of Service
🟠 MEDIUM | No rate limiting on payment API
- Mitigation: Implement rate limiting (10 req/min per user)
- Status: In Progress

### Elevation of Privilege
🟡 LOW | Admin role has excessive database permissions
- Mitigation: Principle of least privilege review
- Status: Planned

/secret-detect - Secret Detection Configuration

Configures pre-commit hooks for secret scanning with entropy analysis.

# Initialize secret detection
/secret-detect --init

# Scan existing codebase
/secret-detect --scan-history

# Configure custom patterns
/secret-detect --add-pattern "CUSTOM_API_KEY_[A-Za-z0-9]{32}"

Generated Pre-commit Hook (`.git/hooks/pre-commit`):

#!/bin/bash
# Auto-generated by /secret-detect

echo "Running secret detection..."

# High-entropy string detection
git diff --cached --name-only | xargs -I {} sh -c '
  if grep -E "[A-Za-z0-9+/]{40,}" {} > /dev/null 2>&1; then
    echo "⚠️  High-entropy string detected in: {}"
    echo "   This may be a secret. Review before committing."
    exit 1
  fi
'

# Known secret patterns
PATTERNS=(
  "AKIA[0-9A-Z]{16}"                    # AWS Access Key
  "sk_live_[0-9a-zA-Z]{24}"             # Stripe Live Key
  "ghp_[0-9a-zA-Z]{36}"                 # GitHub Personal Access Token
  "xox[baprs]-[0-9a-zA-Z]{10,48}"       # Slack Token
  "-----BEGIN (RSA|OPENSSH) PRIVATE KEY" # Private Keys
)