# sparkfinderoven-r01-security-compliance-skills A skill suite that scans code for OWASP vulnerabilities, checks dependencies for CVEs, audits GDPR and SOC 2 readiness, and builds STRIDE threat models. - skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 729 installs · ★ 12 - Author: reason-machines - License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author - Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md - Updated: 2026-10-09 - HTML: https://affpapa.org/en/nevibecode/skills/sparkfinderoven-r01-security-compliance-skills ## What it does The skill gives your agent 10 commands and 5 multi-step workflows around security and compliance. `/owasp-scan` looks for OWASP Top-10 issues and reports CVSS scores with remediation notes. `/dep-cve` checks dependencies against known CVEs and suggests upgrade paths. `/gdpr-audit` and `/soc2-readiness` cover compliance gaps, while `/threat-model` produces a STRIDE analysis with a risk matrix. Least-privilege IAM review, secret detection and incident response playbooks are included too. Install with `npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a claude-code`. The skill file lands at `~/.claude/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md`. Some commands expect input: `/gdpr-audit` reads a `.gdpr-config.yml` file describing data categories, storage and legal basis, and `/threat-model` takes an architecture diagram or a text description of the system. This is a tool for projects that already have code and dependencies to inspect. It reads what exists rather than setting up protection from scratch, so on a repo with no architecture notes or data inventory some commands will have little to work with. Worth gathering those first. The suite also runs on Codex, Cursor, GitHub Copilot, Gemini CLI and OpenCode, though the documented commands and paths assume Claude. ## Install ### Claude Code (native platform) 1. **Skills CLI (Vercel)** ```bash npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a claude-code ``` 2. **Manually: put the files in place** - File: `~/.claude/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/sparkfinderoven-r01-security-compliance-skills/ ### Codex 1. **Skills CLI (Vercel)** ```bash npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a codex ``` 2. **Manually: put the files in place** - File: `.agents/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md` — For all projects use ~/.agents/skills/ ### Cursor 1. **Skills CLI (Vercel)** ```bash npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a cursor ``` 2. **Manually: put the files in place** - File: `.cursor/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/ ### GitHub Copilot 1. **GitHub CLI** ```bash gh skill install reason-machines/security-skills sparkfinderoven-r01-security-compliance-skills ``` 2. **Manually: put the files in place** - File: `.github/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md` ### Gemini CLI 1. **Skills CLI (Vercel)** ```bash npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a gemini-cli ``` 2. **Platform CLI** ```bash gemini skills install https://github.com/reason-machines/security-skills --path skills/sparkfinderoven-r01-security-compliance-skills ``` ### Windsurf (Devin Desktop) **Manually: put the files in place** - File: `.devin/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md` — The legacy .windsurf/skills/ path still works ### OpenCode **Skills CLI (Vercel)** ```bash npx skills add reason-machines/security-skills --skill sparkfinderoven-r01-security-compliance-skills -a opencode ``` ### Claude.ai **Claude.ai** - Zip the folder and upload it in Settings → Capabilities → Skills Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/sparkfinderoven-r01-security-compliance-skills/SKILL.md ## When to use it - find SQL injection and other OWASP Top-10 flaws in source code - check dependencies for known CVEs and decide what to upgrade - map personal data flows against GDPR requirements - assess SOC 2 readiness across the five trust service criteria - build a STRIDE threat model for a new architecture ## Example prompts - scan ./api for OWASP Top-10 vulnerabilities and show only critical ones - check package.json for CVEs and suggest upgrade paths - create a STRIDE threat model for "web app → API Gateway → Lambda → RDS" ## Similar - [security-compliance-audit](https://affpapa.org/en/nevibecode/skills/security-compliance-audit.md) — skill · 665 installs - [security-auditor](https://affpapa.org/en/nevibecode/skills/sickn33-security-auditor.md) — skill · 1400 installs - [security-hardening](https://affpapa.org/en/nevibecode/commands/security-hardening.md) — command · 437 installs - [compliance-tracking](https://affpapa.org/en/nevibecode/skills/compliance-tracking.md) — skill · 3000 installs - [compliance-os](https://affpapa.org/en/nevibecode/plugins/compliance-os.md) — plugin · ★ 28733 - [compliance-check](https://affpapa.org/en/nevibecode/commands/compliance-check.md) — command · ★ 41729 From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 17 cards --- NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md