[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M74ZMA3EGD52Z9P562VG7CSS":3,"skill-same:01M74ZMA3EGD52Z9P562VG7CSS":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":29,"commitSha":30,"skillDirectory":5,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":33,"ownerDescription":6,"updatedAt":34,"install":35,"resources":48},"01M74ZMA3EGD52Z9P562VG7CSS","generating-security-audit-reports",null,"Generate comprehensive security audit reports for applications and systems.\nUse when you need to assess security posture, identify vulnerabilities, evaluate compliance status, or create formal security documentation.\nTrigger with phrases like \"create security audit report\", \"generate security assessment\", \"audit security posture\", or \"PCI-DSS compliance report\".","SamuelChien\u002Fmega-skills-collection","SamuelChien","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F4652114?v=4","01M74KK34WVHA0P5ZYSJRDDFMG","Samuel Chien","01M74KK35FQN1N9VZ9EPTH3P2S",0,"MIT","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fgenerating-security-audit-reports\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: generating-security-audit-reports\ndescription: |\n  Generate comprehensive security audit reports for applications and systems.\n  Use when you need to assess security posture, identify vulnerabilities, evaluate compliance status, or create formal security documentation.\n  Trigger with phrases like \"create security audit report\", \"generate security assessment\", \"audit security posture\", or \"PCI-DSS compliance report\".\n  \nallowed-tools: Read, Write, Edit, Grep, Glob, Bash(security-scan:*), Bash(report-gen:*)\nversion: 1.0.0\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\nlicense: MIT\ncompatible-with: claude-code, codex, openclaw\n---\n# Generating Security Audit Reports\n\n## Overview\n\nAggregate vulnerability scan results, configuration analyses, and compliance assessments into a structured, auditor-ready security report. Map every finding to a CVSS severity, applicable compliance control (PCI-DSS, HIPAA, SOC 2, GDPR), and a prioritized remediation timeline.\n\n## Prerequisites\n\n- Vulnerability scanner outputs (Nmap, Nessus, OpenVAS, OWASP ZAP) available in `${CLAUDE_SKILL_DIR}\u002Fsecurity\u002F`\n- Application and infrastructure configuration files accessible\n- SAST\u002FDAST tool results (e.g., Semgrep, Snyk, Trivy, Bandit)\n- Applicable compliance framework documentation identified (PCI-DSS v4.0, HIPAA Security Rule, SOC 2 TSC, GDPR)\n- Write permissions for report output directory `${CLAUDE_SKILL_DIR}\u002Freports\u002F`\n\n## Instructions\n\n1. Inventory all available security data sources by scanning `${CLAUDE_SKILL_DIR}\u002Fsecurity\u002F` for scanner outputs, log files, and configuration exports.\n2. Parse vulnerability findings and normalize severity using CVSS 3.1 base scores: Critical (9.0-10.0), High (7.0-8.9), Medium (4.0-6.9), Low (0.1-3.9).\n3. Cross-reference each finding against applicable compliance controls. Map to specific PCI-DSS requirements (e.g., Req 6.5 for injection flaws), HIPAA safeguards, or SOC 2 Common Criteria.\n4. Deduplicate findings across scanners and merge related vulnerabilities into consolidated entries with all affected assets listed.\n5. Classify access control weaknesses, encryption gaps, and authentication deficiencies into separate report sections.\n6. Generate an executive summary including total findings by severity, overall risk score, and top-5 critical remediation priorities.\n7. Build a detailed findings table: finding ID, CWE number, affected component, CVSS score, compliance mapping, remediation steps, and evidence links.\n8. Produce a compliance status matrix showing pass\u002Ffail\u002Fpartial for each applicable standard requirement.\n9. Create remediation recommendations with effort estimates (hours), priority ranking, and suggested timelines.\n10. Format the final report as Markdown to `${CLAUDE_SKILL_DIR}\u002Freports\u002Fsecurity-audit-YYYYMMDD.md`. Optionally produce JSON for Jira\u002FServiceNow import.\n\nSee `${CLAUDE_SKILL_DIR}\u002Freferences\u002Fimplementation.md` for the detailed four-phase implementation workflow.\n\n## Output\n\n- **Audit Report**: `${CLAUDE_SKILL_DIR}\u002Freports\u002Fsecurity-audit-YYYYMMDD.md` containing executive summary, detailed findings, compliance matrix, and remediation plan\n- **Findings JSON**: Machine-readable findings for ticketing system import\n- **Compliance Matrix**: Per-requirement pass\u002Ffail\u002Fpartial status for each applicable framework\n- **Remediation Backlog**: Prioritized list with effort estimates and owner assignments\n\n## Error Handling\n\n| Error | Cause | Solution |\n|-------|-------|----------|\n| No security scan results found | Scanner outputs missing from `${CLAUDE_SKILL_DIR}\u002Fsecurity\u002F` | Specify alternate data source paths or run preliminary scans with `nmap -sV` or `trivy fs .` |\n| Cannot assess compliance -- requirements unavailable | Compliance framework checklist not provided | Fall back to OWASP Top 10 and CWE Top 25 as baseline; note limitation in report |\n| Permission denied reading config files | Insufficient filesystem access | Request elevated permissions or provide exported configuration snapshots |\n| Scan results exceed processing capacity | Thousands of findings from multiple scanners | Process in batches by severity (Critical\u002FHigh first), then merge |\n| Conflicting severity ratings across scanners | Different tools score the same vulnerability differently | Use CVSS 3.1 base score as canonical severity; note discrepancies in appendix |\n\n## Examples\n\n- \"Generate a SOC 2 security audit report for the API using scan results in `${CLAUDE_SKILL_DIR}\u002Fsecurity\u002F`.\"\n- \"Create a PCI-DSS compliance-focused security assessment with a prioritized remediation plan for all Critical and High findings.\"\n- \"Produce a HIPAA security audit from the Nessus and Trivy outputs, mapping each finding to the relevant HIPAA safeguard.\"\n\n## Resources\n\n- OWASP Top 10: https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F\n- CWE Top 25: https:\u002F\u002Fcwe.mitre.org\u002Ftop25\u002F\n- NIST Cybersecurity Framework: https:\u002F\u002Fwww.nist.gov\u002Fcyberframework\n- PCI-DSS v4.0 Requirements: https:\u002F\u002Fwww.pcisecuritystandards.org\u002F\n- CVSS 3.1 Calculator: https:\u002F\u002Fwww.first.org\u002Fcvss\u002Fcalculator\u002F3.1\n- `${CLAUDE_SKILL_DIR}\u002Freferences\u002Ferrors.md` -- full error handling reference\n- `${CLAUDE_SKILL_DIR}\u002Freferences\u002Fexamples.md` -- additional usage examples\n- https:\u002F\u002Fintentsolutions.io","# Generating Security Audit Reports\n\n## Overview\n\nAggregate vulnerability scan results, configuration analyses, and compliance assessments into a structured, auditor-ready security report. Map every finding to a CVSS severity, applicable compliance control (PCI-DSS, HIPAA, SOC 2, GDPR), and a prioritized remediation timeline.\n\n## Prerequisites\n\n- Vulnerability scanner outputs (Nmap, Nessus, OpenVAS, OWASP ZAP) available in `${CLAUDE_SKILL_DIR}\u002Fsecurity\u002F`\n- Application and infrastructure configuration files accessible\n- SAST\u002FDAST tool results (e.g., Semgrep, Snyk, Trivy, Bandit)\n- Applicable compliance framework documentation identified (PCI-DSS v4.0, HIPAA Security Rule, SOC 2 TSC, GDPR)\n- Write permissions for report output directory `${CLAUDE_SKILL_DIR}\u002Freports\u002F`\n\n## Instructions\n\n1. Inventory all available security data sources by scanning `${CLAUDE_SKILL_DIR}\u002Fsecurity\u002F` for scanner outputs, log files, and configuration exports.\n2. Parse vulnerability findings and normalize severity using CVSS 3.1 base scores: Critical (9.0-10.0), High (7.0-8.9), Medium (4.0-6.9), Low (0.1-3.9).\n3. Cross-reference each finding against applicable compliance controls. Map to specific PCI-DSS requirements (e.g., Req 6.5 for injection flaws), HIPAA safeguards, or SOC 2 Common Criteria.\n4. Deduplicate findings across scanners and merge related vulnerabilities into consolidated entries with all affected assets listed.\n5. Classify access control weaknesses, encryption gaps, and authentication deficiencies into separate report sections.\n6. Generate an executive summary including total findings by severity, overall risk score, and top-5 critical remediation priorities.\n7. Build a detailed findings table: finding ID, CWE number, affected component, CVSS score, compliance mapping, remediation steps, and evidence links.\n8. Produce a compliance status matrix showing pass\u002Ffail\u002Fpartial for each applicable standard requirement.\n9. Create remediation recommendations with effort estimates (hours), priority ranking, and suggested timelines.\n10. Format the final report as Markdown to `${CLAUDE_SKILL_DIR}\u002Freports\u002Fsecurity-audit-YYYYMMDD.md`. Optionally produce JSON for Jira\u002FServiceNow import.\n\nSee `${CLAUDE_SKILL_DIR}\u002Freferences\u002Fimplementation.md` for the detailed four-phase implementation workflow.\n\n## Output\n\n- **Audit Report**: `${CLAUDE_SKILL_DIR}\u002Freports\u002Fsecurity-audit-YYYYMMDD.md` containing executive summary, detailed findings, compliance matrix, and remediation plan\n- **Findings JSON**: Machine-readable findings for ticketing system import\n- **Compliance Matrix**: Per-requirement pass\u002Ffail\u002Fpartial status for each applicable framework\n- **Remediation Backlog**: Prioritized list with effort estimates and owner assignments\n\n## Error Handling\n\n| Error | Cause | Solution |\n|-------|-------|----------|\n| No security scan results found | Scanner outputs missing from `${CLAUDE_SKILL_DIR}\u002Fsecurity\u002F` | Specify alternate data source paths or run preliminary scans with `nmap -sV` or `trivy fs .` |\n| Cannot assess compliance -- requirements unavailable | Compliance framework checklist not provided | Fall back to OWASP Top 10 and CWE Top 25 as baseline; note limitation in report |\n| Permission denied reading config files | Insufficient filesystem access | Request elevated permissions or provide exported configuration snapshots |\n| Scan results exceed processing capacity | Thousands of findings from multiple scanners | Process in batches by severity (Critical\u002FHigh first), then merge |\n| Conflicting severity ratings across scanners | Different tools score the same vulnerability differently | Use CVSS 3.1 base score as canonical severity; note discrepancies in appendix |\n\n## Examples\n\n- \"Generate a SOC 2 security audit report for the API using scan results in `${CLAUDE_SKILL_DIR}\u002Fsecurity\u002F`.\"\n- \"Create a PCI-DSS compliance-focused security assessment with a prioritized remediation plan for all Critical and High findings.\"\n- \"Produce a HIPAA security audit from the Nessus and Trivy outputs, mapping each finding to the relevant HIPAA safeguard.\"\n\n## Resources\n\n- OWASP Top 10: https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F\n- CWE Top 25: https:\u002F\u002Fcwe.mitre.org\u002Ftop25\u002F\n- NIST Cybersecurity Framework: https:\u002F\u002Fwww.nist.gov\u002Fcyberframework\n- PCI-DSS v4.0 Requirements: https:\u002F\u002Fwww.pcisecuritystandards.org\u002F\n- CVSS 3.1 Calculator: https:\u002F\u002Fwww.first.org\u002Fcvss\u002Fcalculator\u002F3.1\n- `${CLAUDE_SKILL_DIR}\u002Freferences\u002Ferrors.md` -- full error handling reference\n- `${CLAUDE_SKILL_DIR}\u002Freferences\u002Fexamples.md` -- additional usage examples\n- https:\u002F\u002Fintentsolutions.io",{"name":5,"author":24,"license":15,"version":25,"description":26,"allowed-tools":27,"compatible-with":28},"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Generate comprehensive security audit reports for applications and systems.\nUse when you need to assess security posture, identify vulnerabilities, evaluate compliance status, or create formal security documentation.\nTrigger with phrases like \"create security audit report\", \"generate security assessment\", \"audit security posture\", or \"PCI-DSS compliance report\".\n","Read, Write, Edit, Grep, Glob, Bash(security-scan:*), Bash(report-gen:*)","claude-code, codex, openclaw","main","c2b1fdccc779e99ac814e55fb69ca8d71215dd0f","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection","https:\u002F\u002Fgithub.com\u002FSamuelChien","http:\u002F\u002Fsamuelchien.com\u002F","2026-05-26 08:27:14",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add SamuelChien\u002Fmega-skills-collection --skill generating-security-audit-reports",{"tool":41,"command":42},"bunx","bunx skills add SamuelChien\u002Fmega-skills-collection --skill generating-security-audit-reports",{"tool":44,"command":45},"pnpm","pnpm dlx skills add SamuelChien\u002Fmega-skills-collection --skill generating-security-audit-reports","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fgenerating-security-audit-reports\u002FSKILL.md",true,[49,55,61,65,69,73],{"path":50,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":53,"sourceHtmlUrl":54},"assets\u002FREADME.md","ASSET","资产文件",223,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fgenerating-security-audit-reports\u002Fassets\u002FREADME.md",{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"references\u002Ferrors.md","REFERENCE","参考文档",982,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fgenerating-security-audit-reports\u002Freferences\u002Ferrors.md",{"path":62,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":63,"sourceHtmlUrl":64},"references\u002Fexamples.md",205,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fgenerating-security-audit-reports\u002Freferences\u002Fexamples.md",{"path":66,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":67,"sourceHtmlUrl":68},"references\u002Fimplementation.md",1333,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fgenerating-security-audit-reports\u002Freferences\u002Fimplementation.md",{"path":70,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":71,"sourceHtmlUrl":72},"references\u002FREADME.md",67,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fgenerating-security-audit-reports\u002Freferences\u002FREADME.md",{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"scripts\u002FREADME.md","SCRIPT","脚本",498,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fgenerating-security-audit-reports\u002Fscripts\u002FREADME.md",[80,87,94,101,108,116],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":19},"01M76R4WZQZAXGGXMQCA0FZ716","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reactive state patterns with Zustand.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-ts\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":19},"01M76R4T9KENDH7FENGZQHBW4G","zustand-store-creator","Zustand Store Creator - Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":19},"01M76R3YWN84B7SANJ52X799ZE","zero-trust-config-helper","Zero Trust Config Helper - Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":19},"01M76R3HNSV2AEYSKHM915GJ58","zapier-integration-helper","Zapier Integration Helper - Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":19},"01M76R3DJSKAT4FA7DV4BF3GCE","zai-cli","Execute z.AI CLI providing vision, search, reader, and GitHub exploration via CLI and MCP.\nUse when user needs image\u002Fvideo analysis, OCR, UI-to-code conversion, error diagnosis,\nreal-time web search, web page to markdown extraction, or GitHub code exploration.\nTrigger with phrases like \"analyze this image\", \"search the web for\", \"read this page\",\n\"explore this repo\", or \"use zai\". Requires Z_AI_API_KEY.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzai-cli\u002FSKILL.md",[],[],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":19},"01M76R2KAM699XE9AJVAWE4H2E","yt-research","Research competitor YouTube channels, niches, and trending topics for your content strategy.\nUse this skill whenever the user says \"research channels\", \"analyze competitors\", \"find trending topics\",\n\"niche analysis\", \"competitive research\", \"what are other creators doing\", \"scrape YouTube channels\",\nor wants to understand the competitive landscape for a specific tool or topic area. Use when working with yt research. Trigger with 'yt', 'research'.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fyt-research\u002FSKILL.md",[],[]]