sparkfinderoven-r01-security-compliance-skills

# In a Claude Code session, load the skill:
/read ~/.claude/skills/r01-hesreallyhim-awesome-claude-code-security/SKILL.md

# Check available commands
/help security
 
# Test with a simple scan
/owasp-scan --target ./src --dry-run

# Scan entire project
/owasp-scan .
 
# Scan specific directory with custom rules
/owasp-scan ./api --rules owasp-top-10-2021 --severity high
 
# Output JSON report
/owasp-scan ./src --output json > security-report.json

OWASP Scan Results — ./api
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✓ Files scanned: 47
✓ Checks run: 14
⚠ Findings: 3 critical, 5 high, 12 medium

CRITICAL FINDINGS
┌──────┬─────────────────────────────┬──────┬──────────────┐
│ ID   │ Issue                       │ CVSS │ Location     │
├──────┼─────────────────────────────┼──────┼──────────────┤
│ A03  │ SQL Injection               │ 9.8  │ api/search.js│
│ A07  │ JWT None Algorithm Accepted │ 9.1  │ auth/jwt.js  │
└──────┴─────────────────────────────┴──────┴──────────────┘

REMEDIATION (Critical Priority)
• SQL Injection: Use parameterized queries
  - Replace: db.query(`SELECT * FROM users WHERE id=${id}`)
  - With: db.query('SELECT * FROM users WHERE id=?', [id])

# Scan package.json dependencies
/dep-cve --file package.json
 
# Full recursive scan with dev dependencies
/dep-cve --scope full --include-dev
 
# Check specific package
/dep-cve --package express@4.17.1

// In package.json scripts
{
  "scripts": {
    "security:deps": "claude-code /dep-cve --scope full --output md > SECURITY.md",
    "precommit": "claude-code /dep-cve --severity critical --exit-code"
  }
}

# Full GDPR audit
/gdpr-audit --scope full
 
# Audit specific data category
/gdpr-audit --category personal-data --output report
 
# Check consent mechanisms
/gdpr-audit --focus consent --include-cookies

data_inventory:
  - category: personal_identifiable
    fields: [email, name, phone]
    storage: postgresql
    retention_days: 365
    legal_basis: consent
  
  - category: tracking
    fields: [ip_address, user_agent, session_id]
    storage: redis
    retention_days: 90
    legal_basis: legitimate_interest
 
consent_mechanisms:
  - type: cookie_banner
    granular: true
    documented: true
  
processors:
  - name: AWS
    dpa_signed: true
    location: eu-west-1

# Full SOC 2 Type II assessment
/soc2-readiness --type type2
 
# Focus on specific criteria
/soc2-readiness --criteria security,availability
 
# Generate evidence requirements
/soc2-readiness --output evidence-matrix

SOC 2 Readiness Assessment
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Overall Score: 67% (Needs Improvement)

TRUST SERVICE CRITERIA
┌────────────────┬────────┬──────┬────────────────┐
│ Criteria       │ Score  │ Gaps │ Priority       │
├────────────────┼────────┼──────┼────────────────┤
│ Security       │ 78%    │  4   │ Medium         │
│ Availability   │ 45%    │  9   │ 🔴 Critical    │
│ Processing     │ 72%    │  3   │ Low            │
│ Confidentiality│ 89%    │  1   │ Low            │
│ Privacy        │ 54%    │  7   │ High           │
└────────────────┴────────┴──────┴────────────────┘

CRITICAL GAPS (Availability)
• No documented disaster recovery plan
• RTO/RPO not defined for production systems
• Backup restoration not tested in last 90 days

# Create threat model from architecture diagram
/threat-model --input architecture.png
 
# Text-based architecture description
/threat-model --architecture "Web app → API Gateway → Lambda → RDS"
 
# Update existing model
/threat-model --update ./docs/threat-model.md --new-component "Redis Cache"

# Threat Model — Payment Processing System
 
## Architecture
User → HTTPS → Load Balancer → API Server → PostgreSQL
                                    ↓
                               Payment Gateway (Stripe)
 
## STRIDE Analysis
 
### Spoofing
🔴 HIGH | User authentication bypass via JWT manipulation
- Mitigation: Implement RS256 with key rotation
- Status: Open
 
### Tampering
🟠 MEDIUM | SQL injection in payment history endpoint
- Mitigation: Use parameterized queries + ORM
- Status: In Review
 
### Repudiation
🟡 LOW | Insufficient audit logging on failed payments
- Mitigation: Log all payment attempts with user context
- Status: Planned
 
### Information Disclosure
🔴 HIGH | Credit card data in application logs
- Mitigation: PCI-DSS compliant logging, tokenization
- Status: Open
 
### Denial of Service
🟠 MEDIUM | No rate limiting on payment API
- Mitigation: Implement rate limiting (10 req/min per user)
- Status: In Progress
 
### Elevation of Privilege
🟡 LOW | Admin role has excessive database permissions
- Mitigation: Principle of least privilege review
- Status: Planned

# Initialize secret detection
/secret-detect --init
 
# Scan existing codebase
/secret-detect --scan-history
 
# Configure custom patterns
/secret-detect --add-pattern "CUSTOM_API_KEY_[A-Za-z0-9]{32}"

#!/bin/bash
# Auto-generated by /secret-detect
 
echo "Running secret detection..."
 
# High-entropy string detection
git diff --cached --name-only | xargs -I {} sh -c '
  if grep -E "[A-Za-z0-9+/]{40,}" {} > /dev/null 2>&1; then
    echo "⚠️  High-entropy string detected in: {}"
    echo "   This may be a secret. Review before committing."
    exit 1
  fi
'
 
# Known secret patterns
PATTERNS=(
  "AKIA[0-9A-Z]{16}"                    # AWS Access Key
  "sk_live_[0-9a-zA-Z]{24}"             # Stripe Live Key
  "ghp_[0-9a-zA-Z]{36}"                 # GitHub Personal Access Token
  "xox[baprs]-[0-9a-zA-Z]{10,48}"       # Slack Token
  "-----BEGIN (RSA|OPENSSH) PRIVATE KEY" # Private Keys
)
 
for pattern in "${PATTERNS[@]}"; do
  if git diff --cached | grep -E "$pattern" > /dev/null 2>&1; then
    echo "🔴 SECRET DETECTED: Pattern '$pattern'"
    echo "   Remove secret and use environment variables instead."
    exit 1
  fi
done
 
echo "✓ No secrets detected"

# Full IAM audit
/iam-audit
 
# Audit specific AWS account
/iam-audit --provider aws --account-id 123456789012
 
# Check for unused permissions
/iam-audit --focus unused-permissions --days 90

IAM Audit Results
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

OVER-PERMISSIONED ROLES
┌────────────────┬──────────────┬────────────────┐
│ Role           │ Risk Level   │ Issue          │
├────────────────┼──────────────┼────────────────┤
│ dev-full-access│ 🔴 Critical  │ Admin wildcard │
│ lambda-exec    │ 🟠 High      │ s3:* on all    │
│ ec2-instance   │ 🟡 Medium    │ Unused RDS     │
└────────────────┴──────────────┴────────────────┘

STALE ACCESS (90+ days inactive)
• user@example.com — Last login: 147 days ago
• service-account-old — Last used: 203 days ago

MFA GAPS
• 3 admin users without MFA enabled
• 12 privileged roles without MFA requirement

RECOMMENDATIONS
1. Replace dev-full-access with scoped policies
2. Remove s3:* from lambda-exec, grant specific bucket access
3. Deprovision stale accounts within 7 days
4. Enforce MFA for all admin and privileged access

# Create playbook for incident type
/incident-playbook --type data-breach
 
# Interactive incident response
/incident-playbook --interactive --severity critical
 
# Load existing incident
/incident-playbook --load INC-2024-001

# Security Incident Playbook — Data Breach
 
## 1. TRIAGE (0-15 minutes)
 
### Immediate Actions
- [ ] Activate incident response team
- [ ] Establish secure communication channel
- [ ] Document initial discovery and scope
- [ ] Assign incident commander
 
### Initial Assessment
- [ ] Identify affected systems
- [ ] Estimate number of records exposed
- [ ] Classify data sensitivity (PII, PCI, PHI, etc.)
- [ ] Determine if breach is ongoing
 
## 2. CONTAIN (15-60 minutes)
 
### Stop Active Breach
- [ ] Isolate compromised systems from network
- [ ] Rotate all credentials with access to affected systems
- [ ] Block suspicious IP addresses at firewall
- [ ] Disable compromised user accounts
 
### Preserve Evidence
- [ ] Take disk snapshots of affected systems
- [ ] Collect network logs and traffic captures
- [ ] Document all actions with timestamps
- [ ] Maintain chain of custody
 
## 3. ERADICATE (1-4 hours)
 
### Remove Threat
- [ ] Identify root cause and attack vector
- [ ] Patch exploited vulnerabilities
- [ ] Remove malware/backdoors
- [ ] Rebuild compromised systems from clean images
 
### Verify Clean State
- [ ] Run full security scans
- [ ] Check for persistence mechanisms
- [ ] Review user accounts for unauthorized access
- [ ] Audit configuration changes
 
## 4. RECOVER (4-24 hours)
 
### Restore Operations
- [ ] Bring systems back online in controlled manner
- [ ] Monitor for signs of reinfection
- [ ] Restore data from clean backups if needed
- [ ] Update security controls based on lessons learned
 
### Communication
- [ ] Notify affected users within 72 hours (GDPR)
- [ ] File breach notification with regulators
- [ ] Coordinate with legal and PR teams
- [ ] Prepare public statement if required
 
## 5. LESSONS LEARNED (1-2 weeks post-incident)
 
### Post-Mortem
- [ ] Conduct blameless post-mortem
- [ ] Document timeline and decisions
- [ ] Identify preventive measures
- [ ] Update incident response plan
- [ ] Schedule security training
 
### Metrics
- Detection time: ___
- Containment time: ___
- Recovery time: ___
- Records affected: ___
- Estimated cost: ___

# Generate report from findings
/pentest-report --input findings.json
 
# Create executive summary
/pentest-report --type executive --audience board
 
# Technical deep-dive
/pentest-report --type technical --include-exploits

# Generate from data inventory
/privacy-policy --input data-inventory.yml
 
# Update existing policy
/privacy-policy --update privacy.md --add-processor "SendGrid"
 
# Multi-jurisdiction support
/privacy-policy --jurisdictions eu,us-ca,uk

# Run full secure SDLC workflow
/workflows:secure-sdlc --target ./my-app
 
# Run specific stages
/workflows:secure-sdlc --stages "threat-model,code-scan"

# Initiate breach response
/workflows:breach-response --severity critical
 
# Continue from checkpoint
/workflows:breach-response --resume-from contain

# Run compliance audit
/workflows:compliance-audit --frameworks gdpr,soc2,iso27001
 
# Specific scope
/workflows:compliance-audit --scope "user data processing"

# Design zero-trust architecture
/workflows:zero-trust-design --current-architecture aws-vpc.yml

# Assess new vendor
/workflows:vendor-security --vendor "Acme SaaS Inc"
 
# Automated risk scoring
/workflows:vendor-security --questionnaire responses.json --auto-score

# Place in project root or ~/.config/security-skills/
 
# Default severity thresholds
severity:
  block_on: critical
  warn_on: high
  report_all: true
 
# Output preferences
output:
  format: table  # table, json, markdown
  color: true
  verbose: false
 
# Integration settings
integrations:
  jira:
    enabled: true
    url: ${JIRA_URL}
    api_token: ${JIRA_API_TOKEN}
    project_key: SEC
  
  slack:
    enabled: true
    webhook_url: ${SLACK_WEBHOOK_URL}
    channel: "#security-alerts"
  
  github:
    enabled: true
    token: ${GITHUB_TOKEN}
    create_issues: true
 
# Custom rules
custom_rules:
  - id: custom-001
    name: "Internal API Key Pattern"
    pattern: "INTERNAL_[A-Z0-9]{24}"
    severity: high
    
# Compliance frameworks
compliance:
  primary: gdpr
  secondary: [soc2, iso27001]
  audit_schedule: quarterly

# Required for integrations
export JIRA_URL="https://your-org.atlassian.net"
export JIRA_API_TOKEN="your-token-here"
export SLACK_WEBHOOK_URL="https://hooks.slack.com/services/xxx"
export GITHUB_TOKEN="ghp_xxxxxxxxxxxx"
 
# Optional - provider-specific
export AWS_PROFILE="security-audit"
export AZURE_SUBSCRIPTION_ID="xxxxx"
export GCP_PROJECT_ID="your-project"

name: Security Checks
 
on: [push, pull_request]
 
jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Install Security Skills
        run: |
          mkdir -p ~/.claude/skills
          cp -r ./.security-skills ~/.claude/skills/
      
      - name: OWASP Scan
        run: |
          claude-code /owasp-scan . --output json > owasp-report.json
      
      - name: Dependency CVE Scan
        run: |
          claude-code /dep-cve --scope full --severity critical --exit-code
      
      - name: Secret Detection
        run: |
          claude-code /secret-detect --scan-history
      
      - name: Upload Reports
        uses: actions/upload-artifact@v3
        with:
          name: security-reports
          path: |
            owasp-report.json
            SECURITY.md

# .git/hooks/pre-commit
#!/bin/bash
 
echo "🔒 Running security checks..."
 
# Secret detection
if ! claude-code /secret-detect --staged-only; then
  echo "❌ Secret detection failed"
  exit 1
fi
 
# Quick OWASP scan on changed files
CHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(js|py|java|go)$')
if [ -n "$CHANGED_FILES" ]; then
  if ! claude-code /owasp-scan $CHANGED_FILES --fast; then
    echo "❌ Security scan found critical issues"
    exit 1
  fi
fi
 
echo "✅ Security checks passed"

# scripts/weekly-compliance-report.py
import subprocess
import json
from datetime import datetime
 
def run_compliance_scan():
    """Run compliance audit and send report"""
    
    # Run GDPR audit
    gdpr_result = subprocess.run(
        ["claude-code", "/gdpr-audit", "--output", "json"],
        capture_output=True,
        text=True
    )
    
    # Run SOC 2 readiness
    soc2_result = subprocess.run(
        ["claude-code", "/soc2-readiness", "--output", "json"],
        capture_output=True,
        text=True
    )
    
    # Parse results
    gdpr_data = json.loads(gdpr_result.stdout)
    soc2_data = json.loads(soc2_result.stdout)
    
    # Generate summary
    report = f"""
    Compliance Report — {datetime.now().strftime('%Y-%m-%d')}
    
    GDPR Status: {gdpr_data['overall_compliance']}%
    Critical Gaps: {gdpr_data['critical_gaps_count']}
    
    SOC 2 Readiness: {soc2_data['overall_score']}%
    TSC Failures: {soc2_data['tsc_failures']}
    
    Action Required: {gdpr_data['critical_gaps_count'] + soc2_data['critical_gaps_count']} items
    """
    
    # Send to Slack
    subprocess.run([
        "curl", "-X", "POST",
        "-H", "Content-Type: application/json",
        "-d", json.dumps({"text": report}),
        os.environ["SLACK_WEBHOOK_URL"]
    ])
 
if __name__ == "__main__":
    run_compliance_scan()

#!/bin/bash
# scripts/incident-response.sh
 
SEVERITY=$1
INCIDENT_TYPE=$2
 
if [ -z "$SEVERITY" ] || [ -z "$INCIDENT_TYPE" ]; then
  echo "Usage: ./incident-response.sh <critical|high|medium> <data-breach|ransomware|ddos>"
  exit 1
fi
 
# Create incident directory
INCIDENT_ID="INC-$(date +%Y%m%d-%H%M%S)"
mkdir -p "incidents/$INCIDENT_ID"
 
# Generate playbook
claude-code /incident-playbook \
  --type "$INCIDENT_TYPE" \
  --severity "$SEVERITY" \
  --output "incidents/$INCIDENT_ID/playbook.md"
 
# Run IAM audit
claude-code /iam-audit \
  --output json > "incidents/$INCIDENT_ID/iam-audit.json"
 
# Capture current state
echo "Capturing system state..."
claude-code /threat-model \
  --current-state \
  --output "incidents/$INCIDENT_ID/current-threat-model.md"
 
# Create Jira ticket
if [ -n "$JIRA_API_TOKEN" ]; then
  ISSUE_KEY=$(claude-code /integrations:jira:create-incident \
    --incident-id "$INCIDENT_ID" \
    --severity "$SEVERITY" \
    --type "$INCIDENT_TYPE")
  echo "Jira Issue Created: $ISSUE_KEY"
fi
 
# Notify team
echo "🚨 Security Incident: $INCIDENT_ID" | \
  claude-code /integrations:slack:notify \
    --channel security-incidents \
    --attach "incidents/$INCIDENT_ID/playbook.md"
 
echo "Incident $INCIDENT_ID initialized. Follow playbook at incidents/$INCIDENT_ID/playbook.md"

# Verify installation
ls -la ~/.claude/skills/
 
# Reload skill in Claude Code session
/read ~/.claude/skills/r01-hesreallyhim-awesome-claude-code-security/SKILL.md
 
# Check Claude Code version (requires 0.8.0+)
claude-code --version

# Create .security-ignore.yml in project root
ignore_patterns:
  - pattern: "test/fixtures/**"
    reason: "Test data, not production code"
  
  - pattern: "docs/examples/**"
    reason: "Documentation examples"
  
  - finding_id: "OWASP-A03-SQL-001"
    file: "src/legacy/report-builder.js"
    reason: "Acknowledged risk - scheduled for refactor Q3"
    expires: "2024-09-30"

# Test Jira connection
claude-code /integrations:test --service jira
 
# Verify environment variables
env | grep -E '(JIRA|SLACK|GITHUB)'
 
# Debug mode
claude-code /owasp-scan . --debug --verbose

# For large codebases, use incremental scanning
claude-code /owasp-scan --incremental --cache-results
 
# Parallel scanning
claude-code /dep-cve --parallel --workers 4
 
# Exclude directories
claude-code /owasp-scan . --exclude node_modules,vendor,dist

# Validate custom rule syntax
custom_rules:
  - id: custom-api-key
    name: "Custom API Key Detection"
    pattern: "API_KEY_[A-Z0-9]{32}"  # Must be valid regex
    severity: high
    file_types: [".js", ".py", ".env"]  # Limit to specific extensions
    enabled: true  # Explicitly enable

# Test custom rule
claude-code /secret-detect --test-rule custom-api-key --sample "API_KEY_ABC123XYZ789012345678901234567"

# Ensure output directory exists
mkdir -p reports/
 
# Check disk space
df -h
 
# Use streaming output for large reports
claude-code /owasp-scan . --output json --stream > reports/scan-$(date +%Y%m%d).json
 
# Compress old reports
find reports/ -name "*.json" -mtime +30 -exec gzip {} \;

# Python wrapper for security-skills commands
import subprocess
import json
 
class SecuritySkills:
    def __init__(self, config_path=None):
        self.config = config_path
    
    def owasp_scan(self, target, severity="high"):
        result = subprocess.run(
            ["claude-code", "/owasp-scan", target, 
             "--severity", severity, "--output", "json"],
            capture_output=True,
            text=True
        )
        return json.loads(result.stdout)
    
    def dep_cve(self, scope="full"):
        result = subprocess.run(
            ["claude-code", "/dep-cve", 
             "--scope", scope, "--output", "json"],
            capture_output=True,
            text=True
        )
        return json.loads(result.stdout)
    
    def create_incident(self, incident_type, severity):
        result = subprocess.run(
            ["claude-code", "/incident-playbook",
             "--type", incident_type,
             "--severity", severity,
             "--output", "json"],
            capture_output=True,
            text=True
        )
        return json.loads(result.stdout)
 
# Usage
skills = SecuritySkills()
scan_results = skills.owasp_scan("./src", severity="critical")
if scan_results["critical_count"] > 0:
    skills.create_incident("vulnerability-detected", "high")

# workflows/custom-audit.yml
name: Custom Security Audit
description: Organization-specific security workflow
 
steps:
  - name: Pre-audit Setup
    command: /iam-audit
    store_output: iam_results
  
  - name: Code Security
    parallel:
      - command: /owasp-scan
        args: [--target, ./src]
      - command: /dep-cve
        args: [--scope, full]
      - command: /secret-detect
        args: [--scan-history]
  
  - name: Compliance Check
    command: /gdpr-audit
    condition: ${iam_results.high_risk_count} > 0
  
  - name: Generate Report
    command: /pentest-report
    inputs:
      - ${STEP_1_OUTPUT}
      - ${STEP_2_OUTPUT}
      - ${STEP_3_OUTPUT}
  
  - name: Notify Team
    command: /integrations:slack:notify
    args:
      - --channel
      - security-team
      - --attach
      - ${STEP_4_OUTPUT}

# Run custom workflow
claude-code /workflows:run workflows/custom-audit.yml