Generate comprehensive security audit reports for applications and systems.
SkillScore73Maintained
Automatic
◆Security & AppSec packsecuritycomplianceaudit
Last verified 8/30/2026
What it changes
Passed 14 of 19 test cases with the skill, and 6 of 19 without it.
Without skill32%
With skill73%
Checks it passed that the model alone missed
Suggests specifying alternate data source file paths.
Uses the CVSS 3.1 base score to establish canonical severity.
Lists all affected assets under the consolidated finding entry.
and 9 more in the full report
9 fixed7 passed either way6 still failing0 broke
Pass-rate lift
+41 pp
Tokens
+50%
Agent turns
0%
Response time
-7%
Model gemini-3.6-flashMeasured 8/30/2026v116 of 22 cases passed with skill · 19 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 9
Prompt
Where should the final Markdown security audit report file be saved upon completion of processing?
What was checked, without and with the skill
Checked
Without skill
With skill
Saves the report to `${CLAUDE_SKILL_DIR}/reports/security-audit-YYYYMMDD.md`.
Missed
Passed
case-21 · gemini-3.6-flash · 8/30/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md62 lines7 filesincludes scripts
Generating Security Audit Reports
Overview
Aggregate vulnerability scan results, configuration analyses, and compliance assessments into a structured, auditor-ready security report. Map every finding to a CVSS severity, applicable compliance control (PCI-DSS, HIPAA, SOC 2, GDPR), and a prioritized remediation timeline.
Prerequisites
Vulnerability scanner outputs (Nmap, Nessus, OpenVAS, OWASP ZAP) available in ${CLAUDE_SKILL_DIR}/security/
Application and infrastructure configuration files accessible
Write permissions for report output directory ${CLAUDE_SKILL_DIR}/reports/
Instructions
Inventory all available security data sources by scanning ${CLAUDE_SKILL_DIR}/security/ for scanner outputs, log files, and configuration exports.
Parse vulnerability findings and normalize severity using CVSS 3.1 base scores: Critical (9.0-10.0), High (7.0-8.9), Medium (4.0-6.9), Low (0.1-3.9).
Cross-reference each finding against applicable compliance controls. Map to specific PCI-DSS requirements (e.g., Req 6.5 for injection flaws), HIPAA safeguards, or SOC 2 Common Criteria.
Deduplicate findings across scanners and merge related vulnerabilities into consolidated entries with all affected assets listed.
Classify access control weaknesses, encryption gaps, and authentication deficiencies into separate report sections.
Generate an executive summary including total findings by severity, overall risk score, and top-5 critical remediation priorities.
Build a detailed findings table: finding ID, CWE number, affected component, CVSS score, compliance mapping, remediation steps, and evidence links.
Produce a compliance status matrix showing pass/fail/partial for each applicable standard requirement.
Create remediation recommendations with effort estimates (hours), priority ranking, and suggested timelines.
Format the final report as Markdown to ${CLAUDE_SKILL_DIR}/reports/security-audit-YYYYMMDD.md. Optionally produce JSON for Jira/ServiceNow import.
See ${CLAUDE_SKILL_DIR}/references/implementation.md for the detailed four-phase implementation workflow.
Output
Audit Report: ${CLAUDE_SKILL_DIR}/reports/security-audit-YYYYMMDD.md containing executive summary, detailed findings, compliance matrix, and remediation plan
Findings JSON: Machine-readable findings for ticketing system import
Compliance Matrix: Per-requirement pass/fail/partial status for each applicable framework
Remediation Backlog: Prioritized list with effort estimates and owner assignments