# sparkfinderoven-claude-security-compliance-suite

Runs OWASP vulnerability scans, audits third-party packages for CVEs, reviews IAM policies, and evaluates GDPR or SOC2 compliance directly in coding agents.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 724 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/sparkfinderoven-claude-security-compliance-suite/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/sparkfinderoven-claude-security-compliance-suite

## What it does

This suite equips development agents with targeted routines for software security and compliance reviews. It inspects source code for OWASP Top-10 flaws, calculates CVSS scores, and suggests remediations. Threat modeling relies on the STRIDE framework.

Beyond code scanning, it verifies project dependencies against published CVE databases, proposing patch versions. For GDPR reviews, an AST-based parser tracks personal data fields such as email addresses or phone numbers. Secret detection assists in setting up pre-commit defenses.

Auditing library vulnerabilities requires access to project manifest files like `package.json`. Reports format findings into clear tables accompanied by prioritized remediation checklists.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-claude-security-compliance-suite -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/sparkfinderoven-claude-security-compliance-suite/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/sparkfinderoven-claude-security-compliance-suite/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-claude-security-compliance-suite -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/sparkfinderoven-claude-security-compliance-suite/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-claude-security-compliance-suite -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/sparkfinderoven-claude-security-compliance-suite/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills sparkfinderoven-claude-security-compliance-suite
```

2. **Manually: put the files in place**
- File: `.github/skills/sparkfinderoven-claude-security-compliance-suite/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-claude-security-compliance-suite -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/sparkfinderoven-claude-security-compliance-suite
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/sparkfinderoven-claude-security-compliance-suite/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-claude-security-compliance-suite -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/sparkfinderoven-claude-security-compliance-suite/SKILL.md

## When to use it
- scan source code for OWASP Top-10 security flaws
- identify known CVEs in project dependencies with recommended updates
- map data flows and consent gaps for GDPR compliance
- evaluate repository readiness against SOC2 trust service criteria

## Example prompts
- Scan the API directory for vulnerabilities: `/owasp-scan src/api --verbose`
- Check package dependencies for critical flaws: `/dep-cve --severity high,critical`
- Map personal data flows and consent gaps: `/gdpr-audit --output report.md`

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md