Skip to main content
affpapa.org
RU EN
skill CX Codex

sparkfinderoven-r01-security-compliance-skills — Claude Code skill

A skill suite that scans code for OWASP vulnerabilities, checks dependencies for CVEs, audits GDPR and SOC 2 readiness, and builds STRIDE threat models.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a claude-code
Open on GitHub

What sparkfinderoven-r01-security-compliance-skills does

The skill gives your agent 10 commands and 5 multi-step workflows around security and compliance. /owasp-scan looks for OWASP Top-10 issues and reports CVSS scores with remediation notes. /dep-cve checks dependencies against known CVEs and suggests upgrade paths. /gdpr-audit and /soc2-readiness cover compliance gaps, while /threat-model produces a STRIDE analysis with a risk matrix. Least-privilege IAM review, secret detection and incident response playbooks are included too.

Install with npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a claude-code. The skill file lands at ~/.claude/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md. Some commands expect input: /gdpr-audit reads a .gdpr-config.yml file describing data categories, storage and legal basis, and /threat-model takes an architecture diagram or a text description of the system.

This is a tool for projects that already have code and dependencies to inspect. It reads what exists rather than setting up protection from scratch, so on a repo with no architecture notes or data inventory some commands will have little to work with. Worth gathering those first. The suite also runs on Codex, Cursor, GitHub Copilot, Gemini CLI and OpenCode, though the documented commands and paths assume Claude.

What it helps with

  • find SQL injection and other OWASP Top-10 flaws in source code
  • check dependencies for known CVEs and decide what to upgrade
  • map personal data flows against GDPR requirements
  • assess SOC 2 readiness across the five trust service criteria
  • build a STRIDE threat model for a new architecture

Example prompts for the agent

  • scan ./api for OWASP Top-10 vulnerabilities and show only critical ones
  • check package.json for CVEs and suggest upgrade paths
  • create a STRIDE threat model for "web app → API Gateway → Lambda → RDS"

How to install sparkfinderoven-r01-security-compliance-skills

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a claude-code

2Manually: put the files in place

~/.claude/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/sparkfinderoven-r01-security-compliance-skills/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about sparkfinderoven-r01-security-compliance-skills

How do I install sparkfinderoven-r01-security-compliance-skills in Claude?

Run npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a claude-code. The skill file is then placed at ~/.claude/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md.

What does sparkfinderoven-r01-security-compliance-skills do?

It adds commands for scanning code against OWASP Top-10, checking dependencies for CVEs, auditing GDPR and SOC 2 compliance, STRIDE threat modeling and incident response.

What does /gdpr-audit need to run?

It reads a .gdpr-config.yml file listing data categories, fields, storage, retention and legal basis. Without that file the audit relies only on what the agent can find in the code.

Similar skills

Everything for Security →
security-compliance-audit aj-geddes A skill that walks through security compliance checks for SOC 2, GDPR, HIPAA, PCI-DSS and ISO 27001. Useful before certification or an annual audit. CX Codex +1 665installs security-auditor sickn33 Turns your AI coder into a security expert: conducts audits, analyzes vulnerabilities, reviews SDLC and compliance with OWASP, GDPR, PCI-DSS standards. CX Codex +1 1,400installs security-hardening Seth Hobson This command runs a staged security review: vulnerability scanning, threat modeling, and architecture checks. Use it when a project needs a documented hardening pass. CX Codex 437installs compliance-tracking official anthropics Tracks compliance requirements and audit readiness across SOC 2, ISO 27001, GDPR, HIPAA and PCI DSS, helping structure control data for upcoming audits. CX Codex +1 3,000installs compliance-os Alireza Rezvani A meta-orchestrator for multi-framework compliance: picks the frameworks that apply, maps control overlap, simulates audits and builds one evidence pool. ★ 28,733repo stars compliance-check Seth Hobson Works out which regulations apply to your product and points at the controls you still need before an audit. CX Codex ★ 41,729repo stars

From the same set17

malware-warning-bitdefender-crack Flags repositories that disguise malware as cracked Bitdefender software and helps explain the signals behind the threat. CX Codex +1 971installs malware-detection-and-removal A skill for spotting repositories that pose as cracked software and deciding what to do about them. CX Codex +1 952installs npm-security-best-practices Guides npm dependency hardening, supply-chain attack prevention, and safer package-manager settings. Useful when reviewing Node.js installs. CX Codex +1 919installs malware-repository-warning The skill triggers when someone asks for help with a crack, keygen or pre-activated antivirus, and answers with a warning instead of setup steps. CX Codex +1 851installs edgesecurityaccess-wireguard-vpn This skill walks the agent through standing up a WireGuard VPN: build the Go server, add users, and hand out configs over an HTTP API. CX Codex +1 788installs sparkfinderoven-security-compliance-skills A suite of commands and workflows for security and compliance work: OWASP scanning, CVE detection, GDPR audits, SOC 2 readiness, threat modeling. CX Codex +1 759installs pentestify-security-report-generator A skill that turns pentest findings into a structured report: vulnerability tracking, live risk stats and PDF export. CX Codex +1 747installs esaa-security-audit This skill runs 95 checks across 16 security domains and records every finding as an immutable event, so the same repo state yields the same report. CX Codex +1 717installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor