How do I install the Security Compliance skill?

Run npx skillmds@latest add tomevault-io/security-compliance in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Compliance safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Compliance?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Compliance free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Compliance?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Compliance by tomevault-io

Name: Security Compliance
Author: tomevault-io

Security Compliance

Implement security scanning, vulnerability detection, and compliance checks. Use when working with security audits, dependency vulnerabilities, secret detection, CodeQL scanning, SAST/DAST tools, or security best practices. Handles threat modeling and security hardening. Use when this capability is needed.

tomevault-io 3df63d3 2 files · 4.5 KB Updated Sep 17, 2026

File contents

Security & Compliance Guardian

Mission

Maintain and enhance security posture for Brainarr through comprehensive scanning, vulnerability management, and compliance monitoring.

Current Security Infrastructure

✅ CodeQL Scanning: Automated C# security analysis
✅ Secret Detection: Pre-commit hooks + GitLeaks
✅ Dependency Scanning: Dependabot automated updates
✅ SBOM Generation: Software Bill of Materials in releases
✅ Artifact Signing: Cosign keyless signing

Expertise Areas

1. Static Application Security Testing (SAST)

CodeQL query customization for C# and .NET
Security code review automation
Vulnerability pattern detection (injection, XSS, etc.)
False positive management and suppression

2. Dependency Security

Dependabot configuration optimization
Vulnerability remediation strategies
Supply chain attack prevention
License compliance checking

3. Secret Management

Credential scanning (GitLeaks, TruffleHog)
Environment variable security
Secrets rotation policies
API key protection strategies

4. Container Security (Future)

Image vulnerability scanning (Trivy, Grype)
Base image hardening
Runtime security monitoring
Registry security policies

5. Compliance & Auditing

SBOM generation and management
Security audit trails
Compliance reporting (OWASP, CWE)
Penetration testing coordination

Enhancement Opportunities

Dynamic Analysis: Add DAST for runtime vulnerability detection
Container Scanning: Scan Docker images when published
Secrets Rotation: Automate API key rotation
Security Dashboards: Centralized security metrics
Threat Modeling: Regular security architecture reviews

Security Best Practices

Code Security

Input validation on all external data
Parameterized queries (no SQL injection)
Output encoding (prevent XSS)
Secure cryptographic operations
No hardcoded secrets

Dependency Management

Pin dependency versions
Regular security updates
Monitor transitive dependencies
Review dependency changes in PRs

API Security

Authentication required for AI providers
API key encryption at rest
Rate limiting to prevent abuse
Request/response validation

Security Checklist

No hardcoded secrets in code
All dependencies up-to-date
CodeQL findings addressed
SBOM generated for releases
Artifacts signed and verified
Security advisories monitored
Incident response plan documented
Third-party audits completed

Related Skills

code-quality - Security is quality
release-automation - Secure release processes
observability - Security monitoring

Examples

Example 1: Review Security Scan Results

User: "Check the CodeQL findings and fix critical issues" Action: Review security alerts, prioritize by severity, fix vulnerabilities, add suppressions for false positives

Example 2: Update Vulnerable Dependency

User: "Dependabot found a critical vulnerability in Newtonsoft.Json" Action: Review vulnerability details, test compatibility, update version, verify tests pass, merge PR

Example 3: Implement Secret Scanning

User: "Add secret scanning to prevent API key leaks" Action: Configure GitLeaks, add .gitleaks.toml, create pre-commit hooks, scan history, document process

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: security-compliancedescription: Implement security scanning, vulnerability detection, and compliance checks. Use when working with security audits, dependency vulnerabilities, secret detection, CodeQL scanning, SAST/DAST tools, or security best practices. Handles threat modeling and security hardening. Use when this capability is needed.---# Security & Compliance Guardian## MissionMaintain and enhance security posture for Brainarr through comprehensive scanning, vulnerability management, and compliance monitoring.## Current Security Infrastructure- ✅ **CodeQL Scanning**: Automated C# security analysis- ✅ **Secret Detection**: Pre-commit hooks + GitLeaks- ✅ **Dependency Scanning**: Dependabot automated updates- ✅ **SBOM Generation**: Software Bill of Materials in releases- ✅ **Artifact Signing**: Cosign keyless signing## Expertise Areas### 1. Static Application Security Testing (SAST)- CodeQL query customization for C# and .NET- Security code review automation- Vulnerability pattern detection (injection, XSS, etc.)- False positive management and suppression### 2. Dependency Security- Dependabot configuration optimization- Vulnerability remediation strategies- Supply chain attack prevention- License compliance checking### 3. Secret Management- Credential scanning (GitLeaks, TruffleHog)- Environment variable security- Secrets rotation policies- API key protection strategies### 4. Container Security (Future)- Image vulnerability scanning (Trivy, Grype)- Base image hardening- Runtime security monitoring- Registry security policies### 5. Compliance & Auditing- SBOM generation and management- Security audit trails- Compliance reporting (OWASP, CWE)- Penetration testing coordination## Enhancement Opportunities1. **Dynamic Analysis**: Add DAST for runtime vulnerability detection2. **Container Scanning**: Scan Docker images when published3. **Secrets Rotation**: Automate API key rotation4. **Security Dashboards**: Centralized security metrics5. **Threat Modeling**: Regular security architecture reviews## Security Best Practices### Code Security- Input validation on all external data- Parameterized queries (no SQL injection)- Output encoding (prevent XSS)- Secure cryptographic operations- No hardcoded secrets### Dependency Management- Pin dependency versions- Regular security updates- Monitor transitive dependencies- Review dependency changes in PRs### API Security- Authentication required for AI providers- API key encryption at rest- Rate limiting to prevent abuse- Request/response validation## Security Checklist- [ ] No hardcoded secrets in code- [ ] All dependencies up-to-date- [ ] CodeQL findings addressed- [ ] SBOM generated for releases- [ ] Artifacts signed and verified- [ ] Security advisories monitored- [ ] Incident response plan documented- [ ] Third-party audits completed## Related Skills- `code-quality` - Security is quality- `release-automation` - Secure release processes- `observability` - Security monitoring## Examples### Example 1: Review Security Scan Results**User**: "Check the CodeQL findings and fix critical issues"**Action**: Review security alerts, prioritize by severity, fix vulnerabilities, add suppressions for false positives### Example 2: Update Vulnerable Dependency**User**: "Dependabot found a critical vulnerability in Newtonsoft.Json"**Action**: Review vulnerability details, test compatibility, update version, verify tests pass, merge PR### Example 3: Implement Secret Scanning**User**: "Add secret scanning to prevent API key leaks"**Action**: Configure GitLeaks, add .gitleaks.toml, create pre-commit hooks, scan history, document process---> Converted and distributed by [TomeVault](https://tomevault.io/claim/richertunes) — claim your Tome and manage your conversions.

Frequently asked questions