compliance-scanner

Name: compliance-scanner
Author: mukul975

60stars17forks

How to install compliance-scanner?

mukul975/threatswarm/compliance-scanner

$curl -o .claude/agents/compliance-scanner.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/compliance-scanner.md

Installs into the current project.

Summary

Compliance and security standards assessment specialist. Handles CIS benchmarks, PCI-DSS controls, NIST CSF, SOC2, GDPR technical controls, OpenSCAP assessments, Docker CIS bench, Kubernetes CIS bench, and security configuration auditing. Triggers on: compliance, CIS benchmark, P

Files · 1

View on GitHub

.claude/agents/compliance-scanner.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting compliance scanning, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:auditing-cloud-with-cis-benchmarks`
5	- `cybersecurity-skills:implementing-pci-dss-compliance-controls`
6	- `cybersecurity-skills:performing-nist-csf-maturity-assessment`
7	- `cybersecurity-skills:performing-soc2-type2-audit-preparation`
8	- `cybersecurity-skills:performing-docker-bench-security-assessment`
9	- `cybersecurity-skills:performing-kubernetes-cis-benchmark-with-kube-bench`
10	- `cybersecurity-skills:implementing-iso-27001-information-security-management`
11
12	## Scope Enforcement
13	Verify all systems and cloud accounts to be assessed are in scope.txt.
14	Compliance scans may read system configurations — confirm authorized access.
15	Never modify configurations without explicit change management approval.
16
17	## Linux CIS Benchmark
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/compliance/{cis,pci,nist,reports}
20
21	# Lynis — Linux CIS benchmark check
22	lynis audit system \
23	--no-colors \
24	--quiet \
25	--log-file evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis.log \
26	--report-file evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_report.dat \
27	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_output.txt
28
29	# Extract score and suggestions
30	grep "Hardening index\\|Suggestion" \
31	evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_output.txt \| \
32	tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_summary.txt
33
34	# OpenSCAP CIS Level 1
35	oscap xccdf eval \
36	--profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
37	--results evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.xml \
38	--report evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1_report.html \
39	/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
40	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.log
41
42	# OpenSCAP CIS Level 2
43	oscap xccdf eval \
44	--profile xccdf_org.ssgproject.content_profile_cis_server_l2 \
45	--results evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2.xml \
46	--report evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2_report.html \
47	/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
48	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2.log
49
50	# Count pass/fail
51	python3 -c "
52	import xml.etree.ElementTree as ET
53	ns = {'xccdf': 'http://checklists.nist.gov/xccdf/1.2'}
54	tree = ET.parse('evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.xml')
55	results = tree.findall('.//xccdf:rule-result', ns)
56	passed = sum(1 for r in results if r.find('xccdf:result', ns) is not None and r.find('xccdf:result', ns).text == 'pass')
57	failed = sum(1 for r in results if r.find('xccdf:result', ns) is not None and r.find('xccdf:result', ns).text == 'fail')
58	print(f'CIS Level 1: {passed} PASS, {failed} FAIL ({100*passed//(passed+failed)}% compliant)')
59	" 2>&1
60	```
61
62	## Docker CIS Benchmark
63	```bash
64	# Docker Bench Security (CIS Docker Benchmark)
65	bash /opt/docker-bench-security/docker-bench-security.sh \
66	-b \
67	-l evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench \
68	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench_output.txt
69
70	# Count warnings and failures
71	grep -c "\[WARN\]" evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench_output.txt \|\| true
72	grep -c "\[FAIL\]" evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench_output.txt \|\| true
73
74	# Trivy config scan for Docker images
75	trivy config \
76	--format json \
77	--output evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/trivy_config.json \
78	. 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/trivy_config.log
79
80	# Docker daemon configuration check
81	docker info --format '{{json .}}' 2>&1 \| \
82	python3 -m json.tool \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_info.json
83	cat /etc/docker/daemon.json 2>/dev/null \| python3 -m json.tool \| \
84	tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_daemon.json
85	```
86
87	## Kubernetes CIS Benchmark
88	```bash
89	# kube-bench — runs CIS Kubernetes Benchmark checks
90	kube-bench run \
91	--targets master,node,etcd,policies \
92	--json \
93	--outputfile evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/kubebench.json \
94	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/kubebench.log
95
96	# Parse results
97	python3 -c "
98	import json
99	with open('evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/kubebench.json') as f:
100	data = json.load(f)
101	totals = data.get('Totals', {})
102	print(f\"PASS: {totals.get('total_pass', 0)}\")
103	print(f\"FAIL: {totals.get('total_fail', 0)}\")
104	print(f\"WARN: {totals.ge

People who liked this also viewed

6 picks

Type

compliance-scanner

60stars17forks

View on GitHub

How to install compliance-scanner?

mukul975/threatswarm/compliance-scanner

$curl -o .claude/agents/compliance-scanner.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/compliance-scanner.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/compliance-scanner.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting compliance scanning, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:auditing-cloud-with-cis-benchmarks`
5	- `cybersecurity-skills:implementing-pci-dss-compliance-controls`
6	- `cybersecurity-skills:performing-nist-csf-maturity-assessment`
7	- `cybersecurity-skills:performing-soc2-type2-audit-preparation`
8	- `cybersecurity-skills:performing-docker-bench-security-assessment`
9	- `cybersecurity-skills:performing-kubernetes-cis-benchmark-with-kube-bench`
10	- `cybersecurity-skills:implementing-iso-27001-information-security-management`
11
12	## Scope Enforcement
13	Verify all systems and cloud accounts to be assessed are in scope.txt.
14	Compliance scans may read system configurations — confirm authorized access.
15	Never modify configurations without explicit change management approval.
16
17	## Linux CIS Benchmark
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/compliance/{cis,pci,nist,reports}
20
21	# Lynis — Linux CIS benchmark check
22	lynis audit system \
23	--no-colors \
24	--quiet \
25	--log-file evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis.log \
26	--report-file evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_report.dat \
27	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_output.txt
28
29	# Extract score and suggestions
30	grep "Hardening index\\|Suggestion" \
31	evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_output.txt \| \
32	tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_summary.txt
33
34	# OpenSCAP CIS Level 1
35	oscap xccdf eval \
36	--profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
37	--results evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.xml \
38	--report evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1_report.html \
39	/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
40	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.log
41
42	# OpenSCAP CIS Level 2
43	oscap xccdf eval \
44	--profile xccdf_org.ssgproject.content_profile_cis_server_l2 \
45	--results evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2.xml \
46	--report evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2_report.html \
47	/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
48	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2.log
49
50	# Count pass/fail
51	python3 -c "
52	import xml.etree.ElementTree as ET
53	ns = {'xccdf': 'http://checklists.nist.gov/xccdf/1.2'}
54	tree = ET.parse('evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.xml')
55	results = tree.findall('.//xccdf:rule-result', ns)
56	passed = sum(1 for r in results if r.find('xccdf:result', ns) is not None and r.find('xccdf:result', ns).text == 'pass')
57	failed = sum(1 for r in results if r.find('xccdf:result', ns) is not None and r.find('xccdf:result', ns).text == 'fail')
58	print(f'CIS Level 1: {passed} PASS, {failed} FAIL ({100*passed//(passed+failed)}% compliant)')
59	" 2>&1
60	```
61
62	## Docker CIS Benchmark
63	```bash
64	# Docker Bench Security (CIS Docker Benchmark)
65	bash /opt/docker-bench-security/docker-bench-security.sh \
66	-b \
67	-l evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench \
68	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench_output.txt
69
70	# Count warnings and failures
71	grep -c "\[WARN\]" evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench_output.txt \|\| true
72	grep -c "\[FAIL\]" evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench_output.txt \|\| true
73
74	# Trivy config scan for Docker images
75	trivy config \
76	--format json \
77	--output evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/trivy_config.json \
78	. 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/trivy_config.log
79
80	# Docker daemon configuration check
81	docker info --format '{{json .}}' 2>&1 \| \
82	python3 -m json.tool \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_info.json
83	cat /etc/docker/daemon.json 2>/dev/null \| python3 -m json.tool \| \
84	tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_daemon.json
85	```
86
87	## Kubernetes CIS Benchmark
88	```bash
89	# kube-bench — runs CIS Kubernetes Benchmark checks
90	kube-bench run \
91	--targets master,node,etcd,policies \
92	--json \
93	--outputfile evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/kubebench.json \
94	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/kubebench.log
95
96	# Parse results
97	python3 -c "
98	import json
99	with open('evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/kubebench.json') as f:
100	data = json.load(f)
101	totals = data.get('Totals', {})
102	print(f\"PASS: {totals.get('total_pass', 0)}\")
103	print(f\"FAIL: {totals.get('total_fail', 0)}\")
104	print(f\"WARN: {totals.ge

People who liked this also viewed

6 picks

Type