Stats
Actions
Tags
From repo-structure
This skill should be used when the user asks to "check compliance", "validate against OpenSSF", "CII badge requirements", "OWASP standards", "SOC2 compliance", or needs validation against industry security and quality frameworks.
How this skill is triggered — by the user, by Claude, or both
Slash command
/repo-structure:compliance-standardsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Industry standards validation for OpenSSF Scorecard, CII Best Practices, OWASP Top 10, and SOC2 compliance.
Industry standards validation for OpenSSF Scorecard, CII Best Practices, OWASP Top 10, and SOC2 compliance.
Security best practices for open-source projects.
Checks (16 total):
Scoring: 0-10 per check, aggregate 0-10 overall
Threshold mapping:
8.0+ → Passing
6.0-7.9 → Needs improvement
<6.0 → Failing
Core Infrastructure Initiative badge criteria.
Levels:
Key criteria:
Assessment: scripts/check-cii-compliance.sh
Web application security standards (2021).
Top 10 vulnerabilities:
Validation: Check security practices, dependency scanning, input validation
Enterprise security and availability (Type I/II).
Trust Service Criteria:
Repository aspects:
Check compliance:
bash scripts/check-compliance.sh --framework=openssf
bash scripts/check-compliance.sh --framework=cii --level=silver
bash scripts/check-compliance.sh --all
Output:
{
"framework": "openssf-scorecard",
"score": 7.8,
"grade": "Needs Improvement",
"checks": {
"Branch-Protection": 8,
"CI-Tests": 10,
"Code-Review": 6,
"Security-Policy": 10,
"Vulnerabilities": 10
},
"recommendations": [...]
}
Determine relevant frameworks:
compliance:
auto_detect_type: true
Logic:
enabled_frameworksMaps to quality-scoring categories:
See: references/ for detailed requirements.
npx claudepluginhub nsalvacao/nsalvacao-claude-code-plugins --plugin repo-structureChecks code against OWASP Top 10, CWE, NIST, PCI-DSS, HIPAA, GDPR, and secure coding practices. Generates compliance reports with checklists and gap analysis.
Generates compliance reports for PCI DSS, HIPAA, SOC 2, GDPR, ISO 27001 by scanning codebases and configs for security controls, assessing gaps, and producing audit-ready Markdown.
Scans codebases for OWASP Top 10 web security risks including injections, auth flaws, and misconfigurations. Generates reports with remediation guidance for audits.