skill CX Codex

sparkfinderoven-security-compliance-skills — Claude Code skill

Q: How do I install sparkfinderoven-security-compliance-skills in Claude?

Run `npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a claude-code`. The skill lands at `~/.claude/skills/sparkfinderoven-security-compliance-skills/SKILL.md`.

Q: Can the dependency check run in CI/CD?

Yes. `/dep-cve` can emit JSON, and the sample GitHub Actions workflow shows how to fail a build when critical or high findings appear.

A suite of commands and workflows for security and compliance work: OWASP scanning, CVE detection, GDPR audits, SOC 2 readiness, threat modeling.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a claude-code

Open on GitHub

What sparkfinderoven-security-compliance-skills does

The skill adds ten commands and five multi-step workflows to your agent. /owasp-scan checks code against the OWASP Top 10, /dep-cve looks for known vulnerabilities in dependencies, /gdpr-audit maps data flows and consent gaps, and a separate workflow assesses SOC 2 Type II readiness across the five Trust Service Criteria. Other workflows cover threat modeling, secret detection in a codebase, IAM permission audits and an incident response playbook.

Output is structured: finding tables with CVSS scores, CVE IDs, file paths and line numbers, action lists and package upgrade paths. /dep-cve can run in CI/CD and write JSON, so a pipeline can fail on critical findings. /owasp-scan and /gdpr-audit take flags for scope, excluded directories and output format.

Worth installing where code and data already exist — with no sources and no dependency manifests there is nothing to scan. Some workflows lean on repository layout, so run them from the project root. The source text is truncated, so the full command list and environment requirements are not all visible; check SKILL.md after install.

What it helps with

find SQL injection and hardcoded secrets in source files
check dependencies for known CVEs and get upgrade versions
map personal data flows and GDPR consent gaps
assess SOC 2 Type II readiness across five criteria
build an incident response playbook and audit IAM roles

Example prompts for the agent

/owasp-scan src/ --output json
/dep-cve --severity high,critical
/gdpr-audit --focus consent,data-flow

How to install sparkfinderoven-security-compliance-skills

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a claude-code

2Manually: put the files in place

~/.claude/skills/sparkfinderoven-security-compliance-skills/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/sparkfinderoven-security-compliance-skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a codex

2Manually: put the files in place

.agents/skills/sparkfinderoven-security-compliance-skills/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a cursor

2Manually: put the files in place

.cursor/skills/sparkfinderoven-security-compliance-skills/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install reason-machines/security-skills sparkfinderoven-security-compliance-skills

2Manually: put the files in place

.github/skills/sparkfinderoven-security-compliance-skills/SKILL.md

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a gemini-cli

2Platform CLI

gemini skills install https://github.com/reason-machines/security-skills --path skills/sparkfinderoven-security-compliance-skills

Manually: put the files in place

.devin/skills/sparkfinderoven-security-compliance-skills/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about sparkfinderoven-security-compliance-skills

How do I install sparkfinderoven-security-compliance-skills in Claude?

Run npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a claude-code. The skill lands at ~/.claude/skills/sparkfinderoven-security-compliance-skills/SKILL.md.

What does sparkfinderoven-security-compliance-skills do?

It bundles commands and workflows for security and compliance: OWASP Top 10 scanning, CVE detection in dependencies, GDPR audits, SOC 2 readiness, threat modeling and incident response.

Can the dependency check run in CI/CD?

Yes. /dep-cve can emit JSON, and the sample GitHub Actions workflow shows how to fail a build when critical or high findings appear.

Similar skills

Everything for Security →

security-compliance-audit aj-geddes A skill that walks through security compliance checks for SOC 2, GDPR, HIPAA, PCI-DSS and ISO 27001. Useful before certification or an annual audit. CX Codex +1 665installs compliance-tracking official anthropics Tracks compliance requirements and audit readiness across SOC 2, ISO 27001, GDPR, HIPAA and PCI DSS, helping structure control data for upcoming audits. CX Codex +1 3,000installs compliance-check Seth Hobson Works out which regulations apply to your product and points at the controls you still need before an audit. CX Codex ★ 41,729repo stars compliance-os Alireza Rezvani A meta-orchestrator for multi-framework compliance: picks the frameworks that apply, maps control overlap, simulates audits and builds one evidence pool. ★ 28,733repo stars dd-audit-compliance-report datadog-labs Pulls Datadog Audit Trail events into an auditor-ready report mapped to SOC 2 and PCI DSS controls. CX Codex +1 477installs soc2-compliance devops-skills This skill maps SOC 2 Trust Services Criteria to concrete controls and tells you which evidence to collect for Type I and Type II audits. CX Codex +1 344installs

From the same set17

malware-warning-bitdefender-crack Flags repositories that disguise malware as cracked Bitdefender software and helps explain the signals behind the threat. CX Codex +1 971installs malware-detection-and-removal A skill for spotting repositories that pose as cracked software and deciding what to do about them. CX Codex +1 952installs npm-security-best-practices Guides npm dependency hardening, supply-chain attack prevention, and safer package-manager settings. Useful when reviewing Node.js installs. CX Codex +1 919installs malware-repository-warning The skill triggers when someone asks for help with a crack, keygen or pre-activated antivirus, and answers with a warning instead of setup steps. CX Codex +1 851installs edgesecurityaccess-wireguard-vpn This skill walks the agent through standing up a WireGuard VPN: build the Go server, add users, and hand out configs over an HTTP API. CX Codex +1 788installs pentestify-security-report-generator A skill that turns pentest findings into a structured report: vulnerability tracking, live risk stats and PDF export. CX Codex +1 747installs sparkfinderoven-r01-security-compliance-skills A skill suite that scans code for OWASP vulnerabilities, checks dependencies for CVEs, audits GDPR and SOC 2 readiness, and builds STRIDE threat models. CX Codex +1 729installs esaa-security-audit This skill runs 95 checks across 16 security domains and records every finding as an immutable event, so the same repo state yields the same report. CX Codex +1 717installs