Sparkfinderoven Security Compliance Suite

🔒 Security & Compliance Skills Suite

Skill by ara.so — Security Skills collection.

A comprehensive security and compliance automation toolkit derived from awesome-claude-code. Provides 10 specialized commands for vulnerability scanning, compliance auditing, threat modeling, and incident response with structured output and multi-step workflows.

What This Project Does

This skill suite enables AI coding agents to perform:

• Vulnerability Scanning: OWASP Top-10 checks, CVE dependency analysis
• Compliance Auditing: GDPR, SOC2 Type II, ISO27001 gap analysis
• Threat Modeling: STRIDE-based architecture security assessment
• IAM Security: Least-privilege audits, over-permission detection
• Incident Response: Structured playbooks for breach handling
• Secret Detection: Pre-commit hooks with entropy scanning

All commands follow a consistent 5-step interaction pattern with visual progress tracking and prioritized action plans.

Installation

Quick Install

# Clone to Claude skills directory
mkdir -p ~/.claude/skills
cd ~/.claude/skills
git clone https://github.com/sparkfinderoven/r01-hesreallyhim-awesome-claude-code-security.git security-compliance-suite

# Register in Claude Code session
# In Claude Code:
/read ~/.claude/skills/security-compliance-suite/SKILL.md

Manual Setup

# Copy skill files to your project
cp -r ~/.claude/skills/security-compliance-suite/.claude-skills ./

# Or reference directly in your .claude/config.json
{
  "skills": [
    "~/.claude/skills/security-compliance-suite"
  ]
}

Core Commands

OWASP Security Scan

Performs OWASP Top-10 vulnerability analysis with CVSS scoring.

# Scan entire codebase
/owasp-scan .

# Scan specific directory
/owasp-scan ./src/api

# With custom configuration
/owasp-scan . --exclude node_modules --severity high

Output Structure:

• SQL Injection checks (A03:2021)
• Broken Authentication (A07:2021)
• XSS vulnerabilities (A03:2021)
• CSRF protection gaps
• Security misconfiguration (A05:2021)
• CVSS scores with exploit descriptions

Dependency CVE Scanning

# Full dependency tree scan
/dep-cve --scope full

# Production dependencies only
/dep-cve --scope prod --output json

# With upgrade path suggestions
/dep-cve --fix-suggestions

Checks:

• NPM/PyPI/Maven/NuGet packages
• Direct and transitive dependencies
• Exploitability scores (EPSS)
• Available patches and upgrade paths

GDPR Compliance Audit

# Full GDPR audit
/gdpr-audit

# Specific data flow analysis
/gdpr-audit --focus data-flow

# Generate DPA checklist
/gdpr-audit --output dpa-checklist

Analyzes:

• Personal data collection points
• Consent mechanisms and gaps
• Right to erasure implementation
• Data processor agreements (DPA)
• Cross-border transfer safeguards
• Breach notification procedures

SOC2 Readiness Assessment

# Full SOC2 Type II assessment
/soc2-readiness

# Specific Trust Service Criteria
/soc2-readiness --criteria security,availability

# Gap analysis with timeline
/soc2-readiness --timeline 6-months

Evaluates:

• Security (CC6.x controls)
• Availability (A1.x controls)
• Processing Integrity
• Confidentiality
• Privacy
• Evidence collection readiness

Threat Modeling

# STRIDE threat model from architecture
/threat-model ./docs/architecture.md

# With risk matrix output
/threat-model ./design.yaml --risk-matrix

# Focus on specific components
/threat-model --components api,database,auth

Generates:

• Spoofing threats
• Tampering vectors
• Repudiation risks
• Information disclosure
• Denial of service scenarios
• Elevation of privilege paths

Penetration Test Report

# Generate structured pentest report
/pentest-report --target https://api.example.com

# From vulnerability scan results
/pentest-report --import ./scan-results.json

# With executive summary
/pentest-report --format executive

Secret Detection

# Setup pre-commit hook
/secret-detect --setup

# Scan codebase for secrets
/secret-detect --scan .

# Check specific files
/secret-detect ./config/production.yml

Detects:

• API keys (AWS, GitHub, Stripe)
• Private keys and certificates
• Database credentials
• OAuth tokens
• High-entropy strings

IAM Audit

# Full IAM privilege audit
/iam-audit

# Specific cloud provider
/iam-audit --provider aws

# Focus on over-permissions
/iam-audit --focus over-privileged

Identifies:

• Over-permissioned roles
• Stale access (unused >90 days)
• MFA gaps
• Service account issues
• Cross-account access risks

Incident Response Playbook

# Generate incident playbook
/incident-playbook --type data-breach

# For specific scenario
/incident-playbook --scenario "SQL injection exploit"

# With team assignments
/incident-playbook --assign-roles

Phases:

1. Triage & Detection
2. Containment
3. Eradication
4. Recovery
5. Lessons Learned

Privacy Policy Generator

# Generate GDPR/CCPA policy
/privacy-policy --regions eu,us

# From data inventory
/privacy-policy --inventory ./data-map.json

# With specific clauses
/privacy-policy --include cookies,analytics,marketing

Workflows

Secure SDLC Workflow

End-to-end security integration in development lifecycle.

# Full secure SDLC workflow
/workflows:secure-sdlc --target ./src

# Specific phases
/workflows:secure-sdlc --phases threat-model,code-scan,dast

Steps:

1. Threat model design review
2. Static code analysis (SAST)
3. Dynamic testing (DAST)
4. Penetration testing
5. Security sign-off

Breach Response Workflow

# Data breach response workflow
/workflows:breach-response --incident "Customer data exposure"

# With specific scope
/workflows:breach-response --scope "database_users table" --severity high

Process:

1. Detection & initial assessment
2. Impact analysis & legal review
3. Notification (GDPR 72h requirement)
4. Remediation & containment
5. Post-mortem & improvements

Compliance Audit Workflow

# Full compliance audit
/workflows:compliance-audit --standards gdpr,soc2,iso27001

# Gap analysis only
/workflows:compliance-audit --mode gap-analysis --output report.pdf

Zero Trust Design Workflow

# Zero trust architecture design
/workflows:zero-trust-design --scope "API infrastructure"

# Specific layers
/workflows:zero-trust-design --layers identity,network,workload

Layers:

1. Identity (authentication, authorization)
2. Network (segmentation, encryption)
3. Workload (container security, least privilege)
4. Data (encryption, DLP)

Vendor Security Assessment

# Third-party vendor assessment
/workflows:vendor-security --vendor "Acme SaaS Provider"

# With questionnaire
/workflows:vendor-security --questionnaire vsaq --risk-threshold medium

Configuration

Command Options

All commands support these common flags:

--output <format>    # json, md, html, pdf
--severity <level>   # critical, high, medium, low
--exclude <paths>    # Comma-separated exclusion patterns
--verbose           # Detailed logging
--quiet             # Minimal output

Custom Configuration File

Create .security-suite.yaml in project root:

# .security-suite.yaml
scan:
  exclude_paths:
    - node_modules/
    - vendor/
    - test/fixtures/
  severity_threshold: medium
  
owasp:
  enabled_checks:
    - sql_injection
    - xss
    - csrf
    - auth
  custom_rules: ./security-rules.yaml

cve:
  sources:
    - nvd
    - github-advisory
    - snyk
  ignore_dev_dependencies: true

gdpr:
  data_residency: eu-west-1
  dpo_contact: ${DPO_EMAIL}
  representative_contact: ${EU_REP_EMAIL}

soc2:
  target_readiness: 6-months
  auditor: ${AUDITOR_FIRM}
  
notifications:
  slack_webhook: ${SLACK_WEBHOOK_URL}
  email: ${SECURITY_EMAIL}
  pagerduty_key: ${PAGERDUTY_KEY}

Environment Variables