By ajw4sk
Parallel Node-based build of Sec Policy Analyzer. Parses security/compliance policy .docx files (NIST, ISO 27001, SOC 2, PCI DSS, etc.) into the v2 structured JSON schema with full-ancestor IDs, framework-aware policy-id, scopes/assets/linkage fields, an assignment-selectors index, and optional flat CSV. Uses Node.js + adm-zip + fast-xml-parser instead of Python. Works inside the Symplicity Trust Portal repo or in any directory containing only policy .docx files.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Bulk-run the bundled v2 parser against every `.docx` in a target directory. Always invokes via `${CLAUDE_PLUGIN_ROOT}/scripts/run.sh`, so config-file / env / CLI flag resolution is identical to single-docx runs.
Parse a single security/compliance policy .docx into v2 JSON (and optional CSV) via the bundled Node parser wrapper
Verify the Sec Policy Analyzer (Node) environment, persist the verified node binary, and surface the .claude/sec-policy-analyzer-node.local.md config (if any)
A Claude Code plugin marketplace for security/compliance tooling. Currently ships a single plugin: Sec Policy Analyzer (Node) — a parser that turns security/compliance policy .docx files (NIST 800-53, ISO 27001, SOC 2, PCI DSS, …) into a structured v2 JSON schema with full-ancestor IDs, framework-aware policy-id, per-statement scopes & assets, an assignment-selectors index, and an optional flat CSV. No Python required — Node ≥ 18 + two tiny npm packages (adm-zip, fast-xml-parser).
/plugin marketplace add https://github.com/ajw4sk/security-marketplace
/plugin install sec-policy-analyzer-node@security-marketplace
/sec-policy-setup
/sec-policy-setup runs the bundled environment doctor. It checks node and the npm packages declared in the plugin's scripts/package.json. If anything is missing it prints exactly:
cd "${CLAUDE_PLUGIN_ROOT}/scripts" && npm install
The doctor never installs anything on your behalf — run that command yourself and re-run the setup.
Once green:
/parse-policy-v2 ./some-policy.docx --csv
/parse-all-policies . --csv
Outputs land alongside each input docx (*_only.json, *_associated_controls.json, *_complete_associations.json, optional *.csv).
| Plugin | Source | Description |
|---|---|---|
sec-policy-analyzer-node | ./sec-policy-analyzer-node | Node parser for policy .docx files. Produces v2 JSON with pol*-family IDs (polcsec, polstmt, polsubstmt, polcond, polasn, polrole, polresp, polscope), per-statement scopes[] and assets{personnel,infrastructure,applications}, top-level assignment-selectors.by-section index, optional --policy-map compact-linkage mode, and CSV output. |
main — no force-push, no deletion, linear history required, conversation resolution required, admin enforcement on.security-marketplace/
├── .claude-plugin/
│ └── marketplace.json # registers sec-policy-analyzer-node
├── sec-policy-analyzer-node/ # the plugin (self-contained)
│ ├── .claude-plugin/plugin.json
│ ├── README.md, QUICKSTART.md
│ ├── skills/policy-parsing-v2/
│ ├── commands/{parse-policy-v2,parse-all-policies,sec-policy-setup}.md
│ └── scripts/{parse_policy_v2.mjs, package.json, package-lock.json, sec-policy-doctor.sh}
├── LICENSE # MIT
├── SECURITY.md
├── README.md # this file
└── .gitignore
Pull requests welcome. To stay aligned with branch protection, every change to main goes through a PR even from the owner — open a PR, let CI green, then merge. See SECURITY.md for vulnerability reporting.
npx claudepluginhub ajw4sk/security-marketplace --plugin sec-policy-analyzer-nodeComprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
v9.44.1 — Patch release for Gemini environment/version detection and qwen auth gating. Run /octo:setup.
Harness-native ECC operator layer - 67 agents, 271 skills, 92 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
Upstash Context7 MCP server for up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your LLM context.
Comprehensive startup business analysis with market sizing (TAM/SAM/SOM), financial modeling, team planning, and strategic research
Next.js development expertise with skills for App Router, Server Components, Route Handlers, Server Actions, and authentication patterns