How do I install the Security Compliance skill?

Run npx skillmds@latest add cloudchef/security-compliance in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Compliance safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Compliance?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Compliance free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Compliance?

CloudChef (@cloudchef) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Compliance by cloudchef — Agent Skill

Name: Security Compliance
Author: CloudChef

Security Compliance

SmartCMP Security compliance posture and policy-violation skill. Use it to view the overall Security compliance state, list Security violations, analyze one selected Security violation, or mark an already-remediated active violation FIXED after explicit confirmation. This skill owns CMP policy violations; resource-first LLM posture analysis belongs to the resource skill.

CloudChef 54a1705 4 files · 23.5 KB Updated Sep 17, 2026

File contents

security-compliance

Use this Skill for CMP policy-derived Security compliance state and violations. Use the resource Skill when the request starts from a resource and asks for its security posture or associated violations.

Workflow

Call smartcmp_get_security_overview for the overall Security posture.
Call smartcmp_list_security_violations for collection browsing. Keep real violation IDs in metadata and resolve “第 N 条” through the latest list result. Collection rows expose Analyze only.
Phase 1: call smartcmp_analyze_security_violation. Re-read and display the latest violation status, resource, policy, evidence, manual guidance, and the fact that Mark Fixed will not modify the resource. Stop and wait for explicit confirmation; never mark it FIXED in this turn.
Phase 2: only in the next confirmed turn, call smartcmp_mark_security_violation_fixed for the exact freshly analyzed ACTIVED object. This is a status write, not resource remediation.

Evidence and safety rules

Treat CMP violation and policy facts as confirmed evidence. Label model interpretation as inference and unavailable enrichment as missing evidence.
Accept only SECURITY and SECURITY.* violation categories.
Never infer native remediation from remedie, executeParameters, or null task fields. Provide manual guidance and post-change validation only.
Do not equate FIXED with a repaired resource. A later policy evaluation may recreate the violation.
Continue analysis when policy or resource enrichment is unavailable, while reporting the missing evidence explicitly.

Read references/WORKFLOW.md before handling a status change or when pagination and evidence coverage affect the conclusion.

---name: security-compliancedescription: SmartCMP Security compliance posture and policy-violation skill. Use it to view the overall Security compliance state, list Security violations, analyze one selected Security violation, or mark an already-remediated active violation FIXED after explicit confirmation. This skill owns CMP policy violations; resource-first LLM posture analysis belongs to the resource skill.---# security-complianceUse this Skill for CMP policy-derived Security compliance state and violations.Use the `resource` Skill when the request starts from a resource and asks forits security posture or associated violations.## Workflow- Call `smartcmp_get_security_overview` for the overall Security posture.- Call `smartcmp_list_security_violations` for collection browsing. Keep real violation IDs in metadata and resolve “第 N 条” through the latest list result. Collection rows expose Analyze only.- Phase 1: call `smartcmp_analyze_security_violation`. Re-read and display the latest violation status, resource, policy, evidence, manual guidance, and the fact that Mark Fixed will not modify the resource. Stop and wait for explicit confirmation; never mark it FIXED in this turn.- Phase 2: only in the next confirmed turn, call `smartcmp_mark_security_violation_fixed` for the exact freshly analyzed `ACTIVED` object. This is a status write, not resource remediation.## Evidence and safety rules- Treat CMP violation and policy facts as confirmed evidence. Label model interpretation as inference and unavailable enrichment as missing evidence.- Accept only `SECURITY` and `SECURITY.*` violation categories.- Never infer native remediation from `remedie`, `executeParameters`, or null task fields. Provide manual guidance and post-change validation only.- Do not equate `FIXED` with a repaired resource. A later policy evaluation may recreate the violation.- Continue analysis when policy or resource enrichment is unavailable, while reporting the missing evidence explicitly.Read [references/WORKFLOW.md](references/WORKFLOW.md) before handling a statuschange or when pagination and evidence coverage affect the conclusion.

Frequently asked questions