# Security Compliance

> SmartCMP Security compliance posture and policy-violation skill. Use it to view the overall Security compliance state, list Security violations, analyze one selected Security violation, or mark an already-remediated active violation FIXED after explicit confirmation. This skill owns CMP policy violations; resource-first LLM posture analysis belongs to the resource skill.

- Skill: `cloudchef/security-compliance` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add cloudchef/security-compliance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cloudchef/security-compliance/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: CloudChef (https://skillmd.com/u/cloudchef)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cloudchef/security-compliance

---


# security-compliance

Use this Skill for CMP policy-derived Security compliance state and violations.
Use the `resource` Skill when the request starts from a resource and asks for
its security posture or associated violations.

## Workflow

- Call `smartcmp_get_security_overview` for the overall Security posture.
- Call `smartcmp_list_security_violations` for collection browsing. Keep real
  violation IDs in metadata and resolve “第 N 条” through the latest list result.
  Collection rows expose Analyze only.
- Phase 1: call `smartcmp_analyze_security_violation`. Re-read and display the
  latest violation status, resource, policy, evidence, manual guidance, and the
  fact that Mark Fixed will not modify the resource. Stop and wait for explicit
  confirmation; never mark it FIXED in this turn.
- Phase 2: only in the next confirmed turn, call
  `smartcmp_mark_security_violation_fixed` for the exact freshly analyzed
  `ACTIVED` object. This is a status write, not resource remediation.

## Evidence and safety rules

- Treat CMP violation and policy facts as confirmed evidence. Label model
  interpretation as inference and unavailable enrichment as missing evidence.
- Accept only `SECURITY` and `SECURITY.*` violation categories.
- Never infer native remediation from `remedie`, `executeParameters`, or null
  task fields. Provide manual guidance and post-change validation only.
- Do not equate `FIXED` with a repaired resource. A later policy evaluation may
  recreate the violation.
- Continue analysis when policy or resource enrichment is unavailable, while
  reporting the missing evidence explicitly.

Read [references/WORKFLOW.md](references/WORKFLOW.md) before handling a status
change or when pagination and evidence coverage affect the conclusion.