Agent skill · security · alirezarezvani
senior-secops
Find and fix application security problems: security reviews, CVE remediation, hardening, secrets and auth, SOC 2, PCI-DSS, HIPAA and GDPR checks. Use whenever the user asks if their app is secure, needs to patch a vulnerable dependency or prepares for an audit.
Why this skill is useful
Adds 3 executable scripts for security scanning, vulnerability assessment, and compliance checking that provide capabilities not commonly found in public resources.
What it needs
Requires python installed locally. About 5k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
Senior SecOps Engineer Complete toolkit for Security Operations including vulnerability management, compliance verification, secure coding practices, and security automation. --- Table of Contents Core Capabilities Workflows Tool Reference Security Standards Compliance Frameworks Best Practices --- Core Capabilities 1. Security Scanner Scan source code for security vulnerabilities including hardcoded secrets, SQL injection, XSS, command injection, and path traversal. Detects: Hardcoded secrets (API keys, passwords, AWS credentials, GitHub tokens, private keys) SQL injection patterns (string concatenation, f-strings, template literals) XSS vulnerabilities (innerHTML assignment, unsafe DOM manipulation, React unsafe patterns) Command injection (shell=True, exec, eval with user input) Path traversal (file operations with user input) 2. Vulnerability Assessor Scan dependencies for known CVEs across npm, Python, and Go ecosystems. Scans: package.json and package-lock.json (npm) requirements.txt and pyproject.toml (Python) go.mod (Go) Output: CVE IDs with CVSS scores Affected package versions Fixed versions for remediation Overall risk score (0-100) 3. Compliance Checker Verify security compliance against SOC 2, PCI-DSS, HIPAA, and GDPR frameworks. Verifies: Access control implementation Encryption at rest and in transit Audit logging Authentication strength (MFA, password hashing) Security documentation CI/CD security controls --- Workflows Workflow 1: Security Audit Complete security assessment of a codebase. Workflow 2: CI/CD Security Gate Integrate security checks into deployment pipeline. Each step fails the pipeline on its respective exit code — no deployment proceeds past a critical finding. Workflow 3: CVE Triage Steps and scoring rules are in references/vulnerabilitymanagementguide.md (section Workflow 3: CVE Triage). Use vulnerabilityassessor.py to score each CVE. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/senior-secops--c54c64