Skip to content
OpenSmartRoute
Skillv1.0.0

senior-secops

SecOps for application security, vulnerability management, compliance, and secure development. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or me

by borghei(0) 0 installs
Free
Sign in to install

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Imported from borghei/claude-skills (engineering/senior-secops/SKILL.md). Install upstream with npx skills add borghei/claude-skills --skill senior-secops. Copyright stays with the author (MIT + Commons Clause).

Senior SecOps Engineer

The agent scans source code for security vulnerabilities (hardcoded secrets, SQL injection, XSS, command injection), assesses dependency CVEs across npm/Python/Go ecosystems, and verifies compliance against SOC 2, PCI-DSS, HIPAA, and GDPR frameworks.

Core Capabilities

  • Security scanner — detect hardcoded secrets, SQL injection, XSS, command injection, and path traversal in source code.
  • Vulnerability assessor — scan npm / Python / Go dependency manifests for known CVEs with CVSS scores, fixed versions, and a 0-100 risk score.
  • Compliance checker — verify SOC 2, PCI-DSS, HIPAA, and GDPR controls (access control, encryption, audit logging, auth strength).
  • Security workflows — audit, CI/CD security gate, CVE triage (with SLA tiers), and 5-phase incident response.
  • Standards & secure coding — OWASP Top 10 prevention, secure-coding checklist, and language-specific BAD/GOOD patterns.

When to Use

  • Implementing security controls or hardening a codebase.
  • Conducting a security audit or pre-release security pass.
  • Responding to or triaging a newly disclosed CVE.
  • Meeting SOC 2, PCI-DSS, HIPAA, or GDPR compliance requirements.
  • Wiring SAST/dependency/compliance gates into CI/CD.

Clarify First

Before the security pass, confirm these inputs. If any is unknown or vague, ASK — do not assume:

  • Target path — the codebase or dependency manifest to scan (the subject of every scanner)
  • Compliance framework — SOC 2 / PCI-DSS / HIPAA / GDPR (--framework; changes which controls are verified)
  • Severity threshold — the minimum severity to report or gate on (--severity; changes the report and CI pass/fail)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Tools

Tool Purpose Command
security_scanner.py Scan source for secrets, injection, XSS, command injection, path traversal python scripts/security_scanner.py <target> --severity high --json --output report.json
vulnerability_assessor.py Scan dependency manifests for known CVEs and compute risk score python scripts/vulnerability_assessor.py <target> --severity critical
compliance_checker.py Verify SOC 2 / PCI-DSS / HIPAA / GDPR controls python scripts/compliance_checker.py <target> --framework soc2 --json --output soc2.json

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

  • references/workflows-and-tooling.md — capability command reference, the 4 workflows (audit, CI/CD gate, CVE triage, incident response), full per-script flag/output/exit-code tables, and the tech stack. Read when running a workflow or invoking a script with specific flags.
  • references/standards-and-playbook.md — OWASP Top 10 prevention table, secure-coding checklist, SOC 2 / PCI-DSS / HIPAA / GDPR control tables, secure-coding BAD/GOOD code patterns, anti-patterns, troubleshooting table, and success criteria. Read when applying standards or diagnosing scanner behavior.
  • references/security_standards.md — deep OWASP Top 10 with code, secure coding practices, authentication standards, API security, and secrets management. Read for in-depth secure-coding guidance.
  • references/vulnerability_management_guide.md — vulnerability lifecycle, CVE triage process, CVSS scoring, remediation workflows, and dependency scanning. Read when managing CVEs end to end.
  • references/compliance_requirements.md — full SOC 2 / PCI-DSS / HIPAA / GDPR control detail, evidence collection, compliance automation, and audit preparation. Read when preparing for an audit.

Scope & Limitations

This skill covers:

  • Static analysis of source code for common vulnerability classes (secrets, injection, XSS, command injection, path traversal).
  • Dependency vulnerability assessment against a built-in CVE database for npm, Python, and Go ecosystems.
  • Compliance verification for SOC 2 Type II, PCI-DSS v4.0, HIPAA Security Rule, and GDPR.
  • Security workflow orchestration including CI/CD gating, CVE triage, and incident response procedures.

This skill does NOT cover:

  • Dynamic application security testing (DAST) or runtime analysis -- use OWASP ZAP or Burp Suite for live scanning.
  • Infrastructure-as-code security (Terraform, CloudFormation misconfigurations) -- see the senior-devops skill for IaC hardening.
  • Container image scanning or Kubernetes admission control -- see the senior-devops skill or use Trivy directly.
  • Penetration testing execution or red-team operations -- these require specialized tooling and authorized human operators.

Integration Points

Skill Integration Data Flow
senior-devops Infrastructure hardening and CI/CD pipeline configuration Security scan results feed into deployment gates; DevOps provides container and IaC scanning
senior-backend Secure coding patterns and input validation in server-side code SecOps scanner findings drive backend remediation; backend applies parameterized queries and output encoding
senior-qa Security test cases and regression verification after patches Vulnerability reports generate QA test cases; QA confirms fixes do not introduce regressions
senior-architect Threat modeling, defense-in-depth design, and zero-trust architecture Compliance gaps inform architecture decisions; architect provides security design patterns
code-reviewer Security-focused code review and pre-merge analysis Scanner findings prioritize review focus areas; reviewer enforces secure coding standards
senior-fullstack End-to-end security across frontend and API layers (XSS, CSRF, auth) SecOps identifies frontend and API vulnerabilities; fullstack applies framework-level mitigations

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml
targets:
  - https://api.opensmartroute.ai/api/v1/registry/borghei-claude-skills-senior-secops/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

borghei-claude-skills-senior-secops.ocm.jsonjson
{
  "ocm": "1",
  "id": "borghei-claude-skills-senior-secops",
  "kind": "skill",
  "name": "senior-secops",
  "description": "SecOps for application security, vulnerability management, compliance, and secure development. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or meeting compliance requirements.",
  "publisher": "borghei",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "legal"
    ],
    "tags": [
      "skill-md",
      "security-operations",
      "vulnerability-management",
      "incident-response",
      "siem",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "SecOps for application security, vulnerability management, compliance, and secure development. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or meeting compliance requirements."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/borghei/claude-skills",
      "path": "engineering/senior-secops/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/borghei/claude-skills/blob/HEAD/engineering/senior-secops/SKILL.md",
      "key": "borghei/claude-skills/engineering/senior-secops/SKILL.md"
    },
    "license": "MIT + Commons Clause"
  },
  "instructions": "# Senior SecOps Engineer\n\nThe agent scans source code for security vulnerabilities (hardcoded secrets, SQL injection, XSS, command injection), assesses dependency CVEs across npm/Python/Go ecosystems, and verifies compliance against SOC 2, PCI-DSS, HIPAA, and GDPR frameworks.\n\n## Core Capabilities\n\n- **Security scanner** — detect hardcoded secrets, SQL injection, XSS, command injection, and path traversal in source code.\n- **Vulnerability assessor** — scan npm / Python / Go dependency manifests for known CVEs with CVSS scores, fixed versions, and a 0-100 risk score.\n- **Compliance checker** — ",
  "cost": {
    "context_tokens": 1538
  }
}

Fetch it by URL: GET /api/v1/registry/borghei-claude-skills-senior-secops/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.