Agent skill · security · borghei
senior-secops
SecOps for application security, vulnerability management, compliance, and secure development. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or meeting compliance requirements.
Why this skill is useful
Adds 3 executable scripts for security scanning, vulnerability assessment, and compliance checking that are not commonly known or available in public documentation.
What it needs
Requires python installed locally. About 4k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
Senior SecOps Engineer The agent scans source code for security vulnerabilities (hardcoded secrets, SQL injection, XSS, command injection), assesses dependency CVEs across npm/Python/Go ecosystems, and verifies compliance against SOC 2, PCI-DSS, HIPAA, and GDPR frameworks. Core Capabilities Security scanner — detect hardcoded secrets, SQL injection, XSS, command injection, and path traversal in source code. Vulnerability assessor — scan npm / Python / Go dependency manifests for known CVEs with CVSS scores, fixed versions, and a 0-100 risk score. Compliance checker — verify SOC 2, PCI-DSS, HIPAA, and GDPR controls (access control, encryption, audit logging, auth strength). Security workflows — audit, CI/CD security gate, CVE triage (with SLA tiers), and 5-phase incident response. Standards & secure coding — OWASP Top 10 prevention, secure-coding checklist, and language-specific BAD/GOOD patterns. When to Use Implementing security controls or hardening a codebase. Conducting a security audit or pre-release security pass. Responding to or triaging a newly disclosed CVE. Meeting SOC 2, PCI-DSS, HIPAA, or GDPR compliance requirements. Wiring SAST/dependency/compliance gates into CI/CD. Clarify First Before the security pass, confirm these inputs. If any is unknown or vague, ASK — do not assume: [ ] Target path — the codebase or dependency manifest to scan (the subject of every scanner) [ ] Compliance framework — SOC 2 / PCI-DSS / HIPAA / GDPR (--framework; changes which controls are verified) [ ] Severity threshold — the minimum severity to report or gate on (--severity; changes the report and CI pass/fail) Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/senior-secops