skills.rest
Rohithdgrr
RohithdgrrCOMMUNITY
Explore all skills by this author →
GitHub

senior-secops

Scan code for vulnerabilities, assess dependency CVEs, and verify SOC 2, PCI-DSS, HIPAA, and GDPR compliance.

Updated Aug 14, 2026
Search Tags:#owasp#vulnerability assessment#compliance#sast#security scanning#cve#soc2
One-click install
npx skills add https://github.com/Rohithdgrr/REEK-uninstaller --skill senior-secops-rohithdgrr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: senior-secops
Source: https://github.com/Rohithdgrr/REEK-uninstaller/tree/main/.opencode/skills/senior-secops
Command: npx skills add https://github.com/Rohithdgrr/REEK-uninstaller --skill senior-secops-rohithdgrr

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Security reviews, CVE triage, and compliance audits are time-consuming and error-prone when done manually. This Skill automates static security scanning, dependency vulnerability assessment, and compliance verification so teams can catch hardcoded secrets, injection flaws, and regulatory gaps before they reach production. ## Core Features & Use Cases - Security Scanner: Detects hardcoded secrets (API keys, AWS credentials, private keys), SQL injection, XSS, command injection, and path traversal patterns across Python, JavaScript, Go, and other languages, with severity filtering and JSON output for CI/CD. - Vulnerability Assessor: Scans npm, Python, and Go dependency files for known CVEs, reporting CVSS scores, affected versions, and fixed versions with an overall risk score. - Compliance Checker: Verifies controls against SOC 2, PCI-DSS v4.0, HIPAA, and GDPR frameworks, producing compliance scores with evidence and remediation recommendations. - Use Case: Add the scanner to a GitHub Actions pipeline so every pull request fails automatically when critical secrets or high-severity CVEs are introduced. ## Quick Start Run a full security audit on my project by scanning the code for vulnerabilities, checking dependencies for CVEs, and verifying SOC 2 compliance.

Frequently Asked Questions about senior-secops

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan source code for hardcoded secrets and vulnerabilities?▼

Run security_scanner.py against your project directory to detect hardcoded API keys, passwords, AWS credentials, SQL injection, XSS, and command injection patterns. Use --severity to filter results and --json --output to export a report for CI/CD pipelines.

How do I check dependencies for known CVEs in npm, Python, and Go?▼

Run vulnerability_assessor.py on your project to scan package.json, package-lock.json, requirements.txt, pyproject.toml, and go.mod files. It reports CVE IDs with CVSS scores, affected versions, fixed versions, and an overall risk score from 0 to 100.

What compliance frameworks does the compliance checker support?▼

The compliance_checker.py script supports SOC 2 Type II, PCI-DSS v4.0, HIPAA Security Rule, and GDPR. Use --framework to select one or run all frameworks, and it returns a compliance score with per-control evidence and remediation recommendations.

How do I add security scanning to a CI/CD pipeline?▼

Add steps to your GitHub Actions workflow that run security_scanner.py, vulnerability_assessor.py, and compliance_checker.py sequentially. Each script exits with code 2 on critical findings and 1 on high findings, so the pipeline fails automatically on serious issues.

What do the exit codes of the security scanner mean?▼

Exit code 0 means no critical or high findings, exit code 1 indicates high severity findings, and exit code 2 indicates critical severity findings. Use these codes to gate deployments or stop workflows when critical issues are detected.

What are the limitations of pattern-based security scanning?▼

Pattern-based scanning uses regex matching, so it can miss obfuscated vulnerabilities or produce false positives in unusual code. The scanner skips comments, test files, and example values to reduce noise, but deep testing should be handled by dedicated penetration testing.

Related Skills

Explore More Software Engineering Skills→
blueraaiblueraai

Suggest Dependencies to Index

Parse manifest files and source imports to rank dependencies for indexing.

Official
Intermediate
nexus-substratenexus-substrate
18

security-scanning

Triage CodeQL and secret scanning alerts, fix findings, and classify secrets.

Official
Advanced
spallempatispallempati

ci-build-integrity

Enforce immutable CI builds and generate signed SBOMs for supply chain security.

Community
Advanced
summarybotngsummarybotng
2

pentest-validation

Validate security findings through graduated exploitation tiers before reporting.

Official
Advanced