# security-compliance-skills-suite-claude

This skill scans code and dependencies for security issues, supports GDPR, SOC 2 and ISO 27001 checks, and guides incident response.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 754 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-compliance-skills-suite-claude/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/security-compliance-skills-suite-claude

## What it does

The skill adds 10 security commands and 5 multi-step workflows for AI coding agents. It can inspect code for OWASP Top-10 issues, find known CVEs in dependencies, spot exposed secrets, and review IAM permissions for least-privilege gaps. Other workflows cover STRIDE threat models, GDPR, SOC 2 and ISO 27001 reports, zero-trust architecture, and incident response.

Results use structured reports with severity-ranked findings and suggested fixes. Some checks can return JSON, Markdown, or HTML. Dependency scans work with files such as `requirements.txt`, `Pipfile`, `pyproject.toml`, `package.json`, `package-lock.json`, `yarn.lock`, `Gemfile.lock`, `pom.xml`, `build.gradle`, `go.mod`, `go.sum`, and `Cargo.lock`.

That CVE coverage is tied to these dependency formats, so a project using another manifest file will not be covered by this scan.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-compliance-skills-suite-claude -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/security-compliance-skills-suite-claude/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-compliance-skills-suite-claude/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-compliance-skills-suite-claude -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/security-compliance-skills-suite-claude/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-compliance-skills-suite-claude -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/security-compliance-skills-suite-claude/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills security-compliance-skills-suite-claude
```

2. **Manually: put the files in place**
- File: `.github/skills/security-compliance-skills-suite-claude/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-compliance-skills-suite-claude -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/security-compliance-skills-suite-claude
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-compliance-skills-suite-claude/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-compliance-skills-suite-claude -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-compliance-skills-suite-claude/SKILL.md

## When to use it
- scan source code for OWASP Top-10 flaws
- find known CVEs in project dependencies
- map personal-data flows for a GDPR review
- detect secrets and credentials in the repository
- prepare a response plan for a security incident

## Example prompts
- Scan `./src/api` for OWASP issues and show findings at high severity or above.
- Check production dependencies for CVEs with `--min-cvss=7.0`.
- Review `./src` for GDPR gaps and generate a data-flow report.

## Similar
- [security-compliance-audit](https://affpapa.org/en/nevibecode/skills/security-compliance-audit.md) — skill · 665 installs
- [gdpr-compliance](https://affpapa.org/en/nevibecode/skills/gdpr-compliance.md) — skill · 365 installs
- [compliance-specialist](https://affpapa.org/en/nevibecode/agents/compliance-specialist.md) — subagent · 1052 installs
- [security-scan](https://affpapa.org/en/nevibecode/skills/codewithmukesh-security-scan.md) — skill · 2800 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/security-auditor.md) — subagent · 10718 installs
- [healthcare-phi-compliance](https://affpapa.org/en/nevibecode/skills/healthcare-phi-compliance.md) — skill · 4500 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md