🔒 Security & Compliance Skills Suite
Skill by ara.so — Security Skills collection.
A comprehensive security and compliance skill suite derived from hesreallyhim/awesome-claude-code, providing specialized commands and workflows for security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance, and incident response.
What This Project Does
This skill suite provides 10 specialized security commands and 5 multi-step compliance workflows with structured output UI for:
- Vulnerability Scanning: OWASP Top-10 analysis, dependency CVE detection
- Compliance Auditing: GDPR, SOC2, ISO27001 gap analysis
- Security Operations: Threat modeling, penetration testing, IAM audits
- Incident Response: Breach response playbooks and investigation workflows
- Policy Generation: Privacy policies, security documentation
All commands use consistent structured output with progress tracking, findings tables, and prioritized action plans.
Installation
Quick Install (Local Skills Directory)
bash
# Create Claude skills directory if it doesn't existmkdir -p ~/.claude/skills
# Clone the skill suitegit clone https://github.com/sparkfinderoven/r01-hesreallyhim-awesome-claude-code-security.git \ ~/.claude/skills/awesome-claude-code-security
# Activate in Claude Code session# In your IDE with Claude Code, run:/read ~/.claude/skills/awesome-claude-code-security/SKILL.mdManual Installation
bash
# Clone the repositorygit clone https://github.com/sparkfinderoven/r01-hesreallyhim-awesome-claude-code-security.git
# Navigate to project directorycd r01-hesreallyhim-awesome-claude-code-security
# Read the skill documentationcat SKILL.mdVerification
Verify installation by checking available commands:
bash
# List all security commandsls -la ~/.claude/skills/awesome-claude-code-security/
# Expected output:# - SKILL.md (this file)# - README.md (documentation)# - commands/ (individual command definitions)# - workflows/ (multi-step workflow definitions)Core Commands
1. OWASP Top-10 Security Scan
Scans code for OWASP Top-10 vulnerabilities with CVSS scores and remediation guidance.
bash
/owasp-scan <target_directory>
# Options/owasp-scan src/ --format json/owasp-scan . --severity critical,high/owasp-scan api/ --output report.mdExample Output Structure:
╔══════════════════════════════════════════════════╗║ OWASP Security Scan — ./src/api ║╠══════════════════════════════════════════════════╣║ Files scanned ✓ 47 ║║ OWASP checks ✓ 14 ║║ Findings ✗ 8 issues ║╚══════════════════════════════════════════════════╝
FINDINGS (severity: desc)┌──────┬──────────────────────────────┬──────────┬──────────────┐│ Sev │ Vulnerability │ CVSS │ File │├──────┼──────────────────────────────┼──────────┼──────────────┤│ 🔴 │ SQL Injection │ 9.8 │ users.js:42 ││ 🔴 │ JWT None Algorithm │ 9.1 │ auth.js:18 ││ 🟠 │ CORS Misconfiguration │ 6.5 │ server.js:12 │└──────┴──────────────────────────────┴──────────┴──────────────┘
REMEDIATION• SQL Injection: Use parameterized queries or ORM• JWT None: Validate algorithm in token verification• CORS: Restrict origins to known domains2. Dependency CVE Scanner
Scans project dependencies for known CVEs with exploitability scores.
bash
/dep-cve
# Options/dep-cve --scope production/dep-cve --output json > cve-report.json/dep-cve --min-cvss 7.0/dep-cve --show-pathsExample for Node.js project:
bash
# Scans package.json and package-lock.json/dep-cve --scope full
# Output includes:# - CVE IDs with CVSS scores# - Affected package versions# - Upgrade paths# - Exploitability assessmentExpected Output:
╔══════════════════════════════════════════════════╗║ CVE Dependency Scan ║╠══════════════════════════════════════════════════╣║ Dependencies checked ✓ 234 ║║ CVEs found ✗ 12 ║║ Critical ✗ 3 ║║ High ⚠ 5 ║║ Medium ⚠ 4 ║╚══════════════════════════════════════════════════╝
┌─────────────┬──────────┬─────────────┬──────────────┬─────────────┐│ Package │ CVE │ CVSS │ Installed │ Fixed In │├─────────────┼──────────┼─────────────┼──────────────┼─────────────┤│ lodash │ CVE-2021 │ 9.8 🔴 │ 4.17.15 │ 4.17.21 ││ axios │ CVE-2022 │ 8.1 🔴 │ 0.21.0 │ 0.21.4 ││ express │ CVE-2022 │ 7.5 🟠 │ 4.17.1 │ 4.18.2 │└─────────────┴──────────┴─────────────┴──────────────┴─────────────┘
UPGRADE COMMANDSnpm install [email protected]npm install [email protected]npm install [email protected]3. GDPR Compliance Audit
Maps data flows, identifies consent gaps, and generates DPA checklist.
bash
/gdpr-audit <application_path>
# Options/gdpr-audit . --data-map/gdpr-audit src/ --consent-analysis/gdpr-audit . --full-report --output gdpr-audit.pdfExample Analysis:
╔══════════════════════════════════════════════════╗║ GDPR Compliance Audit ║╠══════════════════════════════════════════════════╣║ Data flows mapped ✓ 24 ║║ Personal data types ✓ 8 ║║ Consent gaps ✗ 5 ║║ DPA requirements ⚠ 12/15 met ║╚══════════════════════════════════════════════════╝
DATA FLOW MAPUser Registration → Database (PII: email, name, phone) ↳ Consent: ✗ Missing explicit opt-in ↳ Retention: ⚠ No deletion policy defined ↳ Encryption: ✓ AES-256 at rest
Analytics Pipeline → Third-party (IP address, user agent) ↳ Consent: ✗ No cookie banner ✳ DPA: ⚠ No Data Processing Agreement on file
COMPLIANCE GAPS🔴 Critical: • No cookie consent mechanism implemented • Missing data retention policies in privacy policy • No user data deletion endpoint
🟠 High: • DPA missing for analytics provider • DSAR (data subject access request) workflow undefined4. SOC2 Readiness Assessment
Performs gap analysis across all 5 Trust Service Criteria.
bash
/soc2-readiness
# Options/soc2-readiness --criteria security,availability/soc2-readiness --type type2/soc2-readiness --output xlsxExample Output:
╔══════════════════════════════════════════════════╗║ SOC 2 Type II Readiness Assessment ║╠══════════════════════════════════════════════════╣║ Security ⚠ 65% ready ║║ Availability ✓ 90% ready ║║ Confidentiality ✗ 45% ready ║║ Processing Integrity ⚠ 70% ready ║║ Privacy ✗ 50% ready ║╚══════════════════════════════════════════════════╝
SECURITY GAPS✗ CC6.1: No background checks policy✗ CC6.6: Missing logical access reviews (quarterly)⚠ CC7.2: Incomplete system monitoring
AVAILABILITY GAPS⚠ A1.2: RTO/RPO not documented in DR plan
REMEDIATION TIMELINEQuick Wins (1-2 weeks): • Document RTO/RPO targets • Implement access review schedule
Medium-term (1-3 months): • Establish background check policy • Deploy SIEM for continuous monitoring
Strategic (3-6 months): • Conduct third-party penetration test • Implement data classification framework5. Threat Modeling (STRIDE)
Generates STRIDE threat model for architecture diagrams.
bash
/threat-model <architecture_file>
# Options/threat-model architecture.png --framework stride/threat-model system-design.md --risk-matrix/threat-model . --auto-discoverExample for Web Application:
╔══════════════════════════════════════════════════╗║ STRIDE Threat Model ║╠══════════════════════════════════════════════════╣║ Components analyzed ✓ 8 ║║ Data flows ✓ 12 ║║ Threats identified ✗ 18 ║╚══════════════════════════════════════════════════╝
ARCHITECTURE COMPONENTS• Web Application (React SPA)• API Gateway (nginx)• Backend API (Node.js/Express)• Database (PostgreSQL)• Auth Service (OAuth2)• External Payment Gateway
THREAT ANALYSIS (STRIDE)
[S]poofing 🔴 API Gateway: No mutual TLS for backend communication Impact: High | Likelihood: Medium Mitigation: Implement mTLS between gateway and API
[T]ampering 🟠 Database: SQL injection possible via user input Impact: Critical | Likelihood: Low Mitigation: Use parameterized queries
[R]epudiation 🟡 API: Insufficient audit logging for sensitive operations Impact: Medium | Likelihood: Medium Mitigation: Implement comprehensive audit trail
[I]nformation Disclosure 🔴 Payment Flow: PCI data logged in application logs Impact: Critical | Likelihood: Medium Mitigation: Implement PCI-compliant logging filters
[D]enial of Service 🟠 API: No rate limiting on public endpoints Impact: High | Likelihood: High Mitigation: Implement rate limiting middleware
[E]levation of Privilege 🔴 Auth: JWT lacks role claims validation Impact: Critical | Likelihood: Medium Mitigation: Add RBAC middleware with role enforcement
RISK MATRIX Impact →Likelihood │ Low Medium High Critical───────────┼───────────────────────────────────High │ DoSMedium │ Repud. Spoof InfoDisc, EoPLow │ Tamper6. Penetration Test Report Generator
Structures penetration test findings with executive summary and remediation.
bash
/pentest-report <findings_file>
# Options/pentest-report findings.json --template executive/pentest-report scan-results/ --format pdf/pentest-report . --cvss-threshold 7.0Example Report Structure:
╔══════════════════════════════════════════════════╗║ Penetration Test Report ║║ Target: api.example.com ║║ Date: 2024-01-15 ║╠══════════════════════════════════════════════════╣║ Critical findings ✗ 4 ║║ High findings ✗ 7 ║║ Medium findings ⚠ 12 ║║ Low/Info ✓ 8 ║╚══════════════════════════════════════════════════╝
EXECUTIVE SUMMARYThe penetration test identified 31 findings across the web applicationand API infrastructure. 4 critical vulnerabilities require immediateremediation, including SQL injection and authentication bypass issues.
CRITICAL FINDINGS
1. SQL Injection in User Search (CVSS 9.8) Location: /api/v1/users/search?q= Description: User-supplied input in the 'q' parameter is directly concatenated into SQL query without sanitization. Proof of Concept: GET /api/v1/users/search?q=' OR '1'='1 Remediation: • Implement parameterized queries • Add input validation and sanitization • Deploy WAF rules to detect SQL injection patterns Timeline: Immediate (< 48 hours)
2. Authentication Bypass via JWT None Algorithm (CVSS 9.1) Location: /api/v1/auth/verify Description: JWT library accepts 'none' algorithm, allowing unsigned tokens. Proof of Concept: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4ifQ. Remediation: • Explicitly reject 'none' algorithm in JWT verification • Implement algorithm whitelist • Add token signature validation tests Timeline: Immediate (< 48 hours)
REMEDIATION ROADMAP
Immediate (< 48 hours): ✗ Fix SQL injection vulnerabilities ✗ Patch JWT authentication bypass ✗ Disable debug endpoints in production
Short-term (1-2 weeks): ⚠ Implement rate limiting ⚠ Add CSRF protection ⚠ Deploy Web Application Firewall
Medium-term (1 month): ⚠ Conduct security code review ⚠ Implement security headers (CSP, HSTS) ⚠ Add automated security scanning to CI/CD7. Secret Detection (Pre-commit Hook)
Configures pre-commit hooks for secret and credential detection.
bash
/secret-detect init
# Options/secret-detect scan <directory>/secret-detect --entropy-threshold 4.5/secret-detect --add-patterns custom-patterns.jsonExample Configuration:
bash
# Initialize secret detection/secret-detect init
# Creates .pre-commit-config.yamlGenerated .pre-commit-config.yaml:
yaml
repos: - repo: https://github.com/Yelp/detect-secrets rev: v1.4.0 hooks: - id: detect-secrets args: - '--baseline' - '.secrets.baseline' - '--exclude-files' - 'package-lock.json|.*\.min\.js' - repo: https://github.com/gitleaks/gitleaks rev: v8.18.0 hooks: - id: gitleaks args: - '--verbose' - '--redact'
# Custom entropy scanning - repo: local hooks: - id: high-entropy-strings name: Detect high-entropy strings entry: python scripts/entropy-scan.py language: python args: ['--threshold', '4.5']Scan Example:
bash
/secret-detect scan src/
# Output:╔══════════════════════════════════════════════════╗║ Secret Detection Scan ║╠══════════════════════════════════════════════════╣║ Files scanned ✓ 156 ║║ Secrets detected ✗ 8 ║║ High entropy strings ⚠ 3 ║╚══════════════════════════════════════════════════╝
DETECTED SECRETS┌─────────────────────┬──────────────────┬─────────────────┐│ Type │ File │ Line │├─────────────────────┼──────────────────┼─────────────────┤│ AWS Access Key │ config.js │ 12 ││ Private Key │ certs/dev.key │ 1 ││ API Key (Generic) │ api-client.js │ 45 ││ High Entropy String │ utils.js │ 89 │└─────────────────────┴──────────────────┴─────────────────┘
REMEDIATION• Move secrets to environment variables• Add affected files to .gitignore• Rotate exposed credentials immediately• Review git history with: git log -p <file>8. IAM Least Privilege Audit
Audits IAM roles for over-permissions, stale access, and MFA gaps.
bash
/iam-audit
# Options/iam-audit --provider aws/iam-audit --check-mfa/iam-audit --stale-days 90/iam-audit --output csvExample AWS IAM Audit:
╔══════════════════════════════════════════════════╗║ IAM Least Privilege Audit (AWS) ║╠══════════════════════════════════════════════════╣║ Users analyzed ✓ 24 ║║ Roles analyzed ✓ 18 ║║ Over-permissioned ✗ 7 ║║ Stale access (90d) ✗ 5 ║║ Missing MFA ✗ 3 ║╚══════════════════════════════════════════════════╝
OVER-PERMISSIONED ROLES┌──────────────────┬─────────────────┬──────────────────┐│ Role/User │ Issue │ Last Used │├──────────────────┼─────────────────┼──────────────────┤│ DevOps-Role │ Admin policy │ 2 days ago ││ DataScience-Role │ S3 Full Access │ 15 days ago ││ CI-Pipeline │ IAM permissions │ 1 day ago │└──────────────────┴─────────────────┴──────────────────┘
RECOMMENDATIONS
DevOps-Role: Current: AdministratorAccess Recommended: Custom policy with specific permissions Unused services: RDS, Lambda, DynamoDB Suggested Policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:*", "s3:GetObject", "s3:PutObject", "cloudwatch:PutMetricData" ], "Resource": "*" } ] }
STALE ACCESS (>90 days)• jenkins-user (145 days) - Consider deactivating• legacy-integration (234 days) - Remove• contractor-temp (98 days) - Review and remove
MISSING MFA🔴 admin-user (console access)🔴 ops-team-lead (console access)⚠ backup-operator (API only)
ACTION PLANImmediate: ✗ Enable MFA for admin-user and ops-team-lead ✗ Deactivate access for legacy-integration
Short-term: ⚠ Replace AdministratorAccess with scoped policies ⚠ Implement 90-day access review process ⚠ Add MFA enforcement policy9. Security Incident Playbook
Generates security incident response playbook following NIST framework.
bash
/incident-playbook <incident_type>
# Options/incident-playbook data-breach/incident-playbook ransomware/incident-playbook ddos-attack/incident-playbook --format pdfExample Playbook:
╔══════════════════════════════════════════════════╗║ Security Incident Playbook: Data Breach ║╠══════════════════════════════════════════════════╣║ Framework: NIST SP 800-61 ║║ Phases: 5 ║╚══════════════════════════════════════════════════╝
PHASE 1: DETECTION & TRIAGE (0-1 hour)
Immediate Actions: ☐ Confirm incident severity and scope ☐ Notify Security Team Lead ☐ Activate incident response team ☐ Begin incident log (time, actions, findings) Detection Checklist: ☐ Review SIEM alerts and logs ☐ Check data exfiltration indicators ☐ Identify compromised systems/accounts ☐ Determine data types affected
Key Questions: • What data was accessed/exfiltrated? • How many records affected? • When did the breach occur? • Is the breach ongoing?
PHASE 2: CONTAINMENT (1-4 hours)
Short-term Containment: ☐ Isolate affected systems from network ☐ Disable compromised user accounts ☐ Block malicious IP addresses at firewall ☐ Reset credentials for affected systems ☐ Enable enhanced monitoring
Long-term Containment: ☐ Apply security patches ☐ Implement additional access controls ☐ Deploy IDS/IPS rules ☐ Segment network if not already done
Evidence Preservation: ☐ Take disk/memory snapshots ☐ Preserve logs (application, system, network) ☐ Document all containment actions ☐ Chain of custody for forensic evidence
PHASE 3: ERADICATION (4-24 hours)
☐ Remove malware/backdoors from affected systems ☐ Close vulnerability that enabled breach ☐ Verify no persistence mechanisms remain ☐ Conduct full system security scan ☐ Review and update security configurations
Root Cause Analysis: • Entry point identification • Attack vector analysis • Timeline reconstruction • Identify control failures
PHASE 4: RECOVERY (1-7 days)
☐ Restore systems from clean backups ☐ Verify system integrity before reconnection ☐ Gradually restore services (least critical first) ☐ Enhanced monitoring for 30 days ☐ User access verification
Validation: ☐ Penetration testing of restored systems ☐ Vulnerability scanning ☐ Security control verification
PHASE 5: POST-INCIDENT (7-30 days)
Lessons Learned Meeting (within 48 hours): • What happened? • What was done well? • What could be improved? • What will we do differently?
Deliverables: ☐ Incident report (technical) ☐ Executive summary ☐ Timeline of events ☐ Financial impact assessment ☐ Regulatory notification (if required)
Regulatory Obligations: • GDPR: 72-hour notification to supervisory authority • CCPA: Notification without unreasonable delay • HIPAA: 60-day notification to affected individuals • State breach notification laws (check jurisdictions)
Security Improvements: ☐ Update incident response plan ☐ Implement identified security controls ☐ Conduct security awareness training ☐ Schedule follow-up security assessment
CONTACTS
Security Team: • Security Lead: ENV:SECURITY_LEAD_CONTACT • On-Call SIEM: ENV:SIEM_ONCALL • Forensics Team: ENV:FORENSICS_CONTACT
External: • Legal Counsel: ENV:LEGAL_CONTACT • PR/Communications: ENV:PR_CONTACT • Cyber Insurance: ENV:INSURANCE_CONTACT • Law Enforcement (FBI IC3): https://www.ic3.gov
Regulatory: • GDPR DPA: ENV:DPA_CONTACT • State Attorney General: ENV:STATE_AG_CONTACT10. Privacy Policy Generator
Generates GDPR/CCPA-compliant privacy policy from data inventory.
bash
/privacy-policy <data_inventory_file>
# Options/privacy-policy inventory.json --jurisdiction eu,us,uk/privacy-policy . --auto-discover/privacy-policy data-map.yaml --format htmlExample Data Inventory:
json
{ "personal_data": [ { "type": "contact", "fields": ["email", "name", "phone"], "purpose": "user_account", "retention": "account_lifetime", "third_parties": [] }, { "type": "analytics", "fields": ["ip_address", "user_agent", "session_id"], "purpose": "service_improvement", "retention": "90_days", "third_parties": ["Google Analytics"] } ]}Generated Policy Excerpt:
markdown
# Privacy Policy
Last Updated: 2024-01-15
## 1. Information We Collect
### Contact InformationWe collect your email address, name, and phone number when you:- Create an account- Contact customer support- Subscribe to our newsletter
**Legal Basis (GDPR):** Contract performance, legitimate interest**Retention:** Duration of account plus 30 days
### Analytics DataWe automatically collect:- IP address- Browser type and version- Device information- Pages visited and time spent
**Legal Basis (GDPR):** Legitimate interest (service improvement)**Retention:** 90 days
## 2. How We Use Your Information
We use your information to:- Provide and maintain our services- Send account-related notifications- Improve our products and services- Comply with legal obligations
## 3. Third-Party Service Providers
We share your information with:
**Google Analytics**- Purpose: Website analytics and usage patterns- Data shared: IP address, user agent, page views- Location: United States- Privacy Policy: https://policies.google.com/privacy- Data Processing Agreement: In place
## 4. Your Rights (GDPR)
You have the right to:- **Access:** Request a copy of your personal data- **Rectification:** Correct inaccurate data- **Erasure:** Request deletion of your data- **Restriction:** Limit processing of your data- **Portability:** Receive your data in machine-readable format- **Objection:** Object to processing based on legitimate interest- **Withdraw Consent:** Where processing is based on consent
To exercise these rights, contact: ENV:PRIVACY_CONTACT_EMAIL
## 5. Your Rights (CCPA)
California residents have the right to:- Know what personal information is collected- Know whether personal information is sold or disclosed- Say no to the sale of personal information- Access your personal information- Request deletion of personal information- Equal service and price, even if you exercise your privacy rights
## 6. Data Security
We implement appropriate technical and organizational measures:- Encryption in transit (TLS 1.3)- Encryption at rest (AES-256)- Access controls and authentication- Regular security assessments- Employee security training
## 7. International Data Transfers
Your data may be transferred to and processed in:- United States (Standard Contractual Clauses)- European Union (GDPR compliant)
We ensure appropriate safeguards are in place for all transfers.
## 8. Children's Privacy
Our services are not directed to individuals under 16. We do notknowingly collect personal information from children.
## 9. Contact Information
Data Controller: [Company Name]Email: ENV:PRIVACY_CONTACT_EMAILAddress: [Company Address]
EU Representative: ENV:EU_REP_CONTACTUK Representative: ENV:UK_REP_CONTACT
Supervisory Authority: [Relevant DPA]Multi-Step Workflows
Workflow 1: Secure SDLC (Shift-Left Security)
End-to-end secure development lifecycle implementation.
bash
/workflow:secure-sdlc <project_path>
# Options/workflow:secure-sdlc . --phase all/workflow:secure-sdlc src/ --skip-dastWorkflow Steps:
╔══════════════════════════════════════════════════╗║ Secure SDLC Workflow ║╠══════════════════════════════════════════════════╣║ 1. Threat Model ⟳ In Progress ║║ 2. SAST Scan ░ Pending ║║ 3. Dependency Check ░ Pending ║║ 4. DAST Scan ░ Pending ║║ 5. Penetration Test ░ Pending ║║ 6. Security Sign-off ░ Pending ║╚══════════════════════════════════════════════════╝
PHASE 1: THREAT MODELING Running: /threat-model architecture.md [Output from threat model command...]
PHASE 2: STATIC ANALYSIS Running: /owasp-scan src/ [Output from OWASP scan...]
PHASE 3: DEPENDENCY CHECK Running: /dep-cve --scope full [Output from CVE scan...]
PHASE 4: DYNAMIC TESTING Running DAST against staging environment... [DAST results...]
PHASE 5: PENETRATION TEST Generating penetration test checklist... [Pentest scope and requirements...]
PHASE 6: SECURITY SIGN-OFF Generating security release checklist... RELEASE CRITERIA ☐ All critical vulnerabilities resolved
