# sparkfinderoven-security-compliance-skills

A suite of commands and workflows for security and compliance work: OWASP scanning, CVE detection, GDPR audits, SOC 2 readiness, threat modeling.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 759 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/sparkfinderoven-security-compliance-skills/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/sparkfinderoven-security-compliance-skills

## What it does

The skill adds ten commands and five multi-step workflows to your agent. `/owasp-scan` checks code against the OWASP Top 10, `/dep-cve` looks for known vulnerabilities in dependencies, `/gdpr-audit` maps data flows and consent gaps, and a separate workflow assesses SOC 2 Type II readiness across the five Trust Service Criteria. Other workflows cover threat modeling, secret detection in a codebase, IAM permission audits and an incident response playbook.

Output is structured: finding tables with CVSS scores, CVE IDs, file paths and line numbers, action lists and package upgrade paths. `/dep-cve` can run in CI/CD and write JSON, so a pipeline can fail on critical findings. `/owasp-scan` and `/gdpr-audit` take flags for scope, excluded directories and output format.

Worth installing where code and data already exist — with no sources and no dependency manifests there is nothing to scan. Some workflows lean on repository layout, so run them from the project root. The source text is truncated, so the full command list and environment requirements are not all visible; check `SKILL.md` after install.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/sparkfinderoven-security-compliance-skills/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/sparkfinderoven-security-compliance-skills/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/sparkfinderoven-security-compliance-skills/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/sparkfinderoven-security-compliance-skills/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills sparkfinderoven-security-compliance-skills
```

2. **Manually: put the files in place**
- File: `.github/skills/sparkfinderoven-security-compliance-skills/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/sparkfinderoven-security-compliance-skills
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/sparkfinderoven-security-compliance-skills/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-skills -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/sparkfinderoven-security-compliance-skills/SKILL.md

## When to use it
- find SQL injection and hardcoded secrets in source files
- check dependencies for known CVEs and get upgrade versions
- map personal data flows and GDPR consent gaps
- assess SOC 2 Type II readiness across five criteria
- build an incident response playbook and audit IAM roles

## Example prompts
- /owasp-scan src/ --output json
- /dep-cve --severity high,critical
- /gdpr-audit --focus consent,data-flow

## Similar
- [security-compliance-audit](https://affpapa.org/en/nevibecode/skills/security-compliance-audit.md) — skill · 665 installs
- [compliance-tracking](https://affpapa.org/en/nevibecode/skills/compliance-tracking.md) — skill · 3000 installs
- [compliance-check](https://affpapa.org/en/nevibecode/commands/compliance-check.md) — command · ★ 41729
- [compliance-os](https://affpapa.org/en/nevibecode/plugins/compliance-os.md) — plugin · ★ 28733
- [dd-audit-compliance-report](https://affpapa.org/en/nevibecode/skills/dd-audit-compliance-report.md) — skill · 477 installs
- [soc2-compliance](https://affpapa.org/en/nevibecode/skills/devops-skills-soc2-compliance.md) — skill · 344 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 17 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md