Agent skill · security · jeremylongshore
generating-security-audit-reports
Generate comprehensive security audit reports for applications and systems.
Why this skill is useful
Adds executable scripts for generating comprehensive security audit reports that integrate multiple data sources and compliance frameworks.
What it needs
Requires bash installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Generating Security Audit Reports Overview Aggregate vulnerability scan results, configuration analyses, and compliance assessments into a structured, auditor-ready security report. Map every finding to a CVSS severity, applicable compliance control (PCI-DSS, HIPAA, SOC 2, GDPR), and a prioritized remediation timeline. Prerequisites Vulnerability scanner outputs (Nmap, Nessus, OpenVAS, OWASP ZAP) available in ${CLAUDESKILLDIR}/security/ Application and infrastructure configuration files accessible SAST/DAST tool results (e.g., Semgrep, Snyk, Trivy, Bandit) Applicable compliance framework documentation identified (PCI-DSS v4.0, HIPAA Security Rule, SOC 2 TSC, GDPR) Write permissions for report output directory ${CLAUDESKILLDIR}/reports/ Instructions 1. Inventory all available security data sources by scanning ${CLAUDESKILLDIR}/security/ for scanner outputs, log files, and configuration exports. 2. Parse vulnerability findings and normalize severity using CVSS 3.1 base scores: Critical (9.0-10.0), High (7.0-8.9), Medium (4.0-6.9), Low (0.1-3.9). 3. Cross-reference each finding against applicable compliance controls. Map to specific PCI-DSS requirements (e.g., Req 6.5 for injection flaws), HIPAA safeguards, or SOC 2 Common Criteria. 4. Deduplicate findings across scanners and merge related vulnerabilities into consolidated entries with all affected assets listed. 5. Classify access control weaknesses, encryption gaps, and authentication deficiencies into separate report sections. 6. Generate an executive summary including total findings by severity, overall risk score, and top-5 critical remediation priorities. 7. Build a detailed findings table: finding ID, CWE number, affected component, CVSS score, compliance mapping, remediation steps, and evidence links. 8. Produce a compliance status matrix showing pass/fail/partial for each applicable standard requirement. 9. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/generating-security-audit-reports