This skill should be used when the user asks to "check compliance", "validate against OpenSSF", "CII badge requirements", "OWASP standards", "SOC2 compliance", or needs validation against industry security and quality frameworks.
From repo-structurenpx claudepluginhub nsalvacao/nsalvacao-claude-code-plugins --plugin repo-structureThis skill uses the workspace's default tool permissions.
references/compliance-mapping.mdDispatches parallel agents to independently tackle 2+ tasks like separate test failures or subsystems without shared state or dependencies.
Executes pre-written implementation plans: critically reviews, follows bite-sized steps exactly, runs verifications, tracks progress with checkpoints, uses git worktrees, stops on blockers.
Guides idea refinement into designs: explores context, asks questions one-by-one, proposes approaches, presents sections for approval, writes/review specs before coding.
Industry standards validation for OpenSSF Scorecard, CII Best Practices, OWASP Top 10, and SOC2 compliance.
Security best practices for open-source projects.
Checks (16 total):
Scoring: 0-10 per check, aggregate 0-10 overall
Threshold mapping:
8.0+ → Passing
6.0-7.9 → Needs improvement
<6.0 → Failing
Core Infrastructure Initiative badge criteria.
Levels:
Key criteria:
Assessment: scripts/check-cii-compliance.sh
Web application security standards (2021).
Top 10 vulnerabilities:
Validation: Check security practices, dependency scanning, input validation
Enterprise security and availability (Type I/II).
Trust Service Criteria:
Repository aspects:
Check compliance:
bash scripts/check-compliance.sh --framework=openssf
bash scripts/check-compliance.sh --framework=cii --level=silver
bash scripts/check-compliance.sh --all
Output:
{
"framework": "openssf-scorecard",
"score": 7.8,
"grade": "Needs Improvement",
"checks": {
"Branch-Protection": 8,
"CI-Tests": 10,
"Code-Review": 6,
"Security-Policy": 10,
"Vulnerabilities": 10
},
"recommendations": [...]
}
Determine relevant frameworks:
compliance:
auto_detect_type: true
Logic:
enabled_frameworksMaps to quality-scoring categories:
See: references/ for detailed requirements.