# 2196 Devkitgenerate Security Assessment 9a9a8b1b > Generates comprehensive security assessment document after security audit completion. Use when you need to create a structured security report. - Skill: `tools-only/2196-devkitgenerate-security-assessment-9a9a8b1b` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add tools-only/2196-devkitgenerate-security-assessment-9a9a8b1b` - Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/2196-devkitgenerate-security-assessment-9a9a8b1b/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tools-only (https://skillmd.com/u/tools-only) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/tools-only/2196-devkitgenerate-security-assessment-9a9a8b1b --- ## Overview Generates comprehensive security assessment document after security audit completion. Use when you need to create a structured security report. ## Usage ``` /devkit.generate-security-assessment $ARGUMENTS ``` ## Arguments | Argument | Description | |----------|-------------| | `$ARGUMENTS` | Combined arguments passed to the command | ## Execution Instructions **Agent Selection**: To execute this generation task, use the following approach: - Primary: Use `general-purpose` agent with specialized knowledge of the task domain - Or use appropriate specialized agent if available for the specific generation task ## Security Assessment Document Generation **Target Project**: $ARGUMENTS ### Document Analysis Setup First, I'll analyze the project structure and security audit findings: 1. **Project Analysis**: Examine codebase structure and technologies 2. **Security Review**: Check recent security audit results 3. **Risk Assessment**: Identify critical security areas 4. **Compliance Check**: Verify regulatory requirements ### Document Structure Generation Based on security audit analysis, generating comprehensive assessment document with the following structure: --- # Security Assessment Document **Language**: Language detection from arguments... **Format**: Output format configuration... **Generation Date**: Current timestamp... ### 1. Project Overview and Security Scope #### Project Description [Auto-generated based on codebase analysis] **Identified Technologies**: [Framework detection from package.json/pom.xml] **Application Size**: [Lines of code, number of files] **Application Type**: [Web, API, Desktop, Mobile] #### Security Scope **Assessment Perimeter**: - Authentication and Authorization - Data Protection - Security Architecture - Incident Management **Exclusions**: [Components not in scope] ### 2. Identity and Access Management #### Authentication [Analysis of authentication mechanisms] - **Identified Methods**: JWT, OAuth2, Session-based - **Security Configurations**: Spring Security, Passport.js, NextAuth - **Two-Factor Authentication**: Implementation status - **Password Policies**: Current password strength requirements #### Authorization [Access control analysis] - **Role-Based Access Control (RBAC)**: Implementation status - **Method-Level Security**: @PreAuthorize, @Secured annotations - **API Protection**: Endpoint security configuration - **Resource Access Control**: File and data access policies #### Session Management [Session security evaluation] - **Session Timeout**: Current timeout configurations - **Session Fixation Protection**: Security measures implemented - **Concurrent Session Control**: Multiple session policies - **Secure Cookie Configuration**: HttpOnly, Secure, SameSite settings ### 3. Data Protection #### Encryption [Cryptography implementation analysis] - **Data in Transit**: TLS/SSL configurations - **Data at Rest**: Database encryption, file system encryption - **Algorithms Used**: AES, RSA, bcrypt for passwords - **Key Management**: Secret storage and rotation policies #### Data Masking [Sensitive data handling] - **PII Protection**: Personal identifiable information masking - **Credit Card Data**: PCI-DSS compliance measures - **Log Sanitization**: Sensitive data removal from logs - **Database Field Encryption**: Column-level encryption #### Backup and Recovery [Data backup strategies] - **Backup Schedule**: Automated backup frequency - **Backup Encryption**: Encrypted backup storage - **Recovery Testing**: Regular restore procedure validation - **Disaster Recovery**: Business continuity planning ### 4. Threat Protection #### Firewall and WAF [Network security configuration] - **Web Application Firewall**: Implementation status - **Ingress/Egress Filtering**: Network traffic controls - **DDoS Protection**: Rate limiting and traffic monitoring - **API Gateway Security**: Request validation and filtering #### Common Attack Protection [Attack prevention measures] - **SQL Injection**: Parameterized queries, ORMs usage - **XSS Protection**: Input sanitization, CSP headers - **CSRF Protection**: Anti-CSRF tokens - **File Upload Security**: File type validation, virus scanning #### Vulnerability Monitoring [Security monitoring setup] - **Dependency Scanning**: npm audit, OWASP Dependency Check - **Static Analysis**: Code quality security tools - **Dynamic Testing**: Security testing automation - **Security Headers**: HSTS, X-Frame-Options, CSP ### 5. Code Security #### Secure Development Guidelines [Coding standards analysis] - **Input Validation**: Validation frameworks usage - **Error Handling**: Secure error response patterns - **Security Libraries**: Cryptography, authentication libraries - **Code Quality**: Static analysis tools integration #### Code Review Process [Security review practices] - **Security Code Review**: Peer review for security - **Automated Security Testing**: CI/CD security gates - **Security Standards**: OWASP ASVS compliance - **Documentation**: Security requirements documentation #### Security Testing [Security testing strategy] - **Unit Tests Security**: Security-focused unit tests - **Integration Tests**: End-to-end security validation - **Penetration Testing**: Regular security assessments - **Security Monitoring**: Runtime security monitoring ### 6. Incident Management #### Incident Response Plan [Incident response procedures] - **Detection**: Security incident identification - **Response**: Immediate response actions - **Containment**: Incident containment strategies - **Recovery**: Service restoration procedures #### Reporting [Incident reporting structure] - **Logging Strategy**: Comprehensive logging setup - **Audit Trails**: User action tracking - **Security Metrics**: Key security indicators - **Compliance Reporting**: Regulatory reporting requirements #### Communication [Stakeholder communication] - **Internal Notification**: Team alerting mechanisms - **External Communication**: Customer notification procedures - **Regulatory Reporting**: Legal requirement compliance - **Public Relations**: Crisis communication plan ### 7. Training and Awareness #### Staff Training [Security education programs] - **Developer Security**: Secure coding practices training - **Security Awareness**: Phishing awareness programs - **Compliance Training**: Regulatory requirement education - **Regular Updates**: Ongoing security education #### Attack Simulations [Security validation exercises] - **Phishing Simulations**: Employee security awareness testing - **Penetration Testing**: Regular security assessments - **Red Team Exercises**: Adversarial simulation testing - **Security Drills**: Incident response practice ### 8. Compliance and Regulations #### Regulatory Compliance [Compliance framework analysis] - **GDPR**: General Data Protection Regulation compliance - **SOX**: Sarbanes-Oxley Act requirements - **PCI-DSS**: Payment Card Industry Data Security Standard - **ISO 27001**: Information Security Management #### Security Audits [Audit procedures and results] - **Internal Audits**: Regular security assessments - **External Audits**: Third-party security evaluations - **Compliance Checks**: Automated compliance validation - **Audit Findings**: Security improvement recommendations ### 9. Maintenance and Updates #### Patch Management [Update and patch procedures] - **Vulnerability Scanning**: Regular security scans - **Patch Schedule**: Automated update procedures - **Testing Protocol**: Pre-deployment testing - **Rollback Procedures**: Update failure recovery #### Continuous Monitoring [Ongoing security monitoring] - **SIEM Integration**: Security information and event management - **Real-time Alerting**: Immediate threat notification - **Performance Monitoring**: Security impact on performance - **Anomaly Detection**: Behavioral analysis systems ### 10. Appendices #### Glossary - **RBAC**: Role-Based Access Control - **OWASP**: Open Web Application Security Project - **TLS**: Transport Layer Security - **PII**: Personal Identifiable Information #### Useful Resources - **OWASP Top 10**: https://owasp.org/www-project-top-ten/ - **Security Guidelines**: Internal security documentation - **Tools**: Security assessment tools used - **Contacts**: Security team contact information --- ## Document Generation Process 1. **Analyze Codebase Structure**: Detect technologies, frameworks, and security implementations 2. **Review Security Audit Results**: Parse findings from recent security assessments 3. **Generate Risk Assessment**: Create project-specific security risk evaluation 4. **Format Document**: Apply requested language and output format 5. **Include Recommendations**: Provide actionable security improvement suggestions 6. **Add Compliance Mapping**: Map to relevant security standards and regulations **Output**: Complete security assessment document ready for stakeholder review and security planning. Language: $ARGUMENTS Format: Based on user preference (Markdown default) --- ## Examples ```bash - `/developer-kit:devkit.generate-security-assessment en-US markdown` - Generate English assessment in Markdown - `/developer-kit:devkit.generate-security-assessment it-IT pdf` - Generate Italian assessment in PDF - `/developer-kit:devkit.generate-security-assessment docx` - Generate English assessment in DOCX ```