# sparkfinderoven-security-compliance-suite

Automates OWASP vulnerability checks, dependency CVE scans, and SOC2 or GDPR audits inside your development workflow. Designed for security assessments during coding.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 720 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/sparkfinderoven-security-compliance-suite/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/sparkfinderoven-security-compliance-suite

## What it does

This skill equips your agent with specialized routines for source code audits. It inspects repositories for OWASP Top-10 flaws and exposed secret keys across NPM, PyPI, Maven, or NuGet configurations. Findings include CVSS ratings and EPSS exploitability metrics.

Beyond basic scanning, it manages governance workflows. You can evaluate compliance gaps against SOC2 Type II and GDPR requirements, or create structured response playbooks for data breaches. Architectural evaluations rely on the STRIDE framework. Each command executes through a 5-step sequence with prioritized remediation items.

Threat modeling requires detailed architecture files, or the STRIDE breakdown stays superficial.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-suite -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/sparkfinderoven-security-compliance-suite/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/sparkfinderoven-security-compliance-suite/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-suite -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/sparkfinderoven-security-compliance-suite/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-suite -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/sparkfinderoven-security-compliance-suite/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills sparkfinderoven-security-compliance-suite
```

2. **Manually: put the files in place**
- File: `.github/skills/sparkfinderoven-security-compliance-suite/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-suite -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/sparkfinderoven-security-compliance-suite
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/sparkfinderoven-security-compliance-suite/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill sparkfinderoven-security-compliance-suite -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/sparkfinderoven-security-compliance-suite/SKILL.md

## When to use it
- scan source directories for OWASP Top-10 security flaws
- audit project dependencies for published CVEs and upgrade paths
- build STRIDE threat matrices directly from architecture documentation
- evaluate compliance gaps for GDPR and SOC2 Type II criteria
- configure pre-commit checks to catch leaked API credentials and tokens

## Example prompts
- Audit our backend code: /owasp-scan ./src/api --severity high
- Check our project dependencies: /dep-cve --scope full --fix-suggestions
- Generate a threat model from specs: /threat-model ./docs/architecture.md

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md