Skip to content
Beta Multi-model support (OpenAI, Gemini, and more) launching soon.
RBA RBA Skills

security-readiness-reviewer

v0.1.0 ExperimentalNo security review by Dakota Smith

Install

Pick the surface you use. Plugins run inside Claude Code, which is available in the terminal CLI, the desktop app on Mac and Windows, the web app at claude.ai/code, and the VS Code and JetBrains extensions. The slash commands are identical on every surface.

From inside any Claude Code session — terminal, desktop app, web app, or IDE extension:

  1. Add the RBA Skills marketplace (only needed once per machine):

    /plugin marketplace add rbaconsulting/rba-skills-plugin

  2. Install security-readiness-reviewer:

    /plugin install security-readiness-reviewer@rba-ai-hub

  3. Activate it without restarting:

    /reload-plugins

Overview

Security & Privacy Readiness Reviewer

A comprehensive security and privacy review toolkit for RBA digital experience projects. This plugin provides structured, repeatable coverage across the full security readiness surface: OWASP Top 10:2025 code auditing, dependency/CVE scanning, HTTP security-headers review, GDPR/CCPA consent and PII inventory, prioritised remediation planning, and client-facing executive summaries. Works across all RBA platform stacks — Sitecore, Optimizely, Umbraco, Azure-hosted .NET APIs, and headless front-ends.

What's in this bundle

Artifact Purpose
owasp-security-audit skill Full OWASP Top 10:2025-aligned code audit of source files, diffs, or directories — severity-ranked findings with CWE references and platform-specific fixes
dependency-cve-scan skill Scans NuGet and npm lock files for known CVEs; grades severity via CVSS; flags transitive + direct vulnerable packages with upgrade paths
privacy-consent-review skill Audits consent mechanisms, cookie banners, PII handling, data-subject rights flows, and privacy policy completeness against GDPR/CCPA requirements
security-headers-audit skill Reviews HTTP response headers (CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, etc.) against OWASP Secure Headers recommendations
security-remediation-plan skill Synthesises findings from any combination of the above skills into a prioritised, sprint-ready remediation backlog with effort estimates
security-client-summary skill Produces a polished, non-technical executive summary suitable for client sign-off, governance review, or handover documentation
security-reviewer agent Autonomous sub-agent that orchestrates the full review pipeline: audit → scan → headers → privacy → plan → summary
/rba-security-review command Quick entry-point slash command that routes to the right skill based on what you pass it

When to use

  • Pre-launch security gate: run before go-live on any client project — covers code, dependencies, headers, and privacy in a single pass
  • End-of-sprint security check: run owasp-security-audit on the diff after any sprint that touched auth, data access, or APIs
  • Dependency audit: run dependency-cve-scan weekly in CI or whenever you add a new NuGet/npm package
  • Privacy and consent review: run privacy-consent-review before launching in any EU or California market, or when updating consent flows
  • Headers hardening: run security-headers-audit after infrastructure changes, CDN config updates, or web.config / Next.js config edits
  • Client deliverable: run security-client-summary to generate the formal security sign-off document for client governance

Platform adapters

All skills are platform-agnostic by default, with specific adapter sections for:

  • Sitecore XM Cloud / SXA — Identity Server config, Media Library upload restrictions, rendering host CSP, item security, Helix layer trust boundaries
  • Optimizely CMS 12+ — Role-based editor permissions, visitor-group data handling, A/B test data retention, Forms PII fields
  • Umbraco 13+ — Member authentication hardening, Surface form anti-forgery, Examine index exposure, Media folder permissions
  • .NET / ASP.NET Core — OWASP .NET Cheat Sheet patterns, minimal-API auth, EF Core parameterisation, Data Protection API usage
  • TypeScript / React / Next.js — CSP nonce injection, SRI on third-party assets, env-variable exposure, server action validation

How to install

claude plugin install security-readiness-reviewer@rba-ai-hub

Then invoke any skill directly or use the /rba-security-review slash command as a single entry point.

  • code-review-enforcer — broader PR review covering security, performance, and accessibility
  • accessibility-auditor — dedicated WCAG 2.2 AA accessibility review
  • cloud-devops-accelerator — Azure infrastructure security (NSGs, Key Vault, managed identities)

Bundled artifacts

Skills

  • dependency-cve-scan — Scans NuGet (packages.lock.json / *.csproj) and npm (package-lock.json / yarn.lock) dependency trees for known CVEs using dotnet CLI and npm audit. Grades findings by CVSS severity, distinguishes direct from transitive vulnerabilities, and produces an upgrade path for every affected package. Use weekly in CI, before go-live, and whenever a new package is added.
  • privacy-consent-review — Audits consent mechanisms, cookie banners, PII handling, data-subject rights flows, and privacy policy completeness against GDPR and CCPA requirements. Covers front-end consent UX, server-side PII data flows, third-party tag/pixel governance, and Sitecore/Optimizely/Umbraco CMS-specific data handling. Produces a gap analysis and a prioritised remediation checklist.
  • security-client-summary — Produces a polished, non-technical executive security summary suitable for client sign-off, governance review, or project handover. Translates OWASP, CVE, headers, and privacy findings into business-risk language with a RAG-status dashboard, risk narrative, remediation timeline, and residual-risk statement. Tone: professional, confident, no unnecessary alarm.
  • security-headers-audit — Reviews HTTP response headers against the OWASP Secure Headers Project recommendations: CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and more. Reads configuration from web.config, appsettings.json, Next.js config, nginx.conf, or Azure Front Door rules. Outputs a graded headers report and production-ready config snippets to close every gap.
  • security-remediation-plan — Synthesises findings from owasp-security-audit, dependency-cve-scan, security-headers-audit, and privacy-consent-review into a single prioritised, sprint-ready remediation backlog. Deduplicates overlapping findings, assigns RICE-style effort estimates, groups by sprint, and generates Azure DevOps work-item YAML ready to import. Use after running any combination of the other security skills, or to triage an existing security report.
  • owasp-security-audit — OWASP Top 10:2025-aligned source-code security audit of a file, directory, or git diff. Produces a severity-ranked findings report with CWE references, exact vulnerable code snippets, and platform-specific remediation steps for Sitecore, Optimizely, Umbraco, and .NET/TypeScript stacks. Use as a pre-merge gate on any change touching auth, data access, APIs, or third-party integrations.

Agents

  • security-reviewer — Autonomous security review sub-agent that orchestrates the full RBA security readiness pipeline: OWASP code audit → dependency CVE scan → security headers review → privacy/consent gap analysis → remediation plan → client summary. Invoke when you want a single end-to-end security review without calling each skill manually.

Slash Commands

  • /rba-security-review — Quick-entry slash command for the Security & Privacy Readiness Reviewer plugin. Routes to the appropriate skill based on arguments: 'owasp', 'cve', 'headers', 'privacy', 'plan', 'summary', or 'all' for the full pipeline via the security-reviewer agent.
Technical details
Homepage
https://rba-skills.tylerschroeder.net/plugins/security-readiness-reviewer/
License
MIT
Maturity
experimental
Security review
No security review
Owners
  • security
  • engineering
Platforms
sitecore, optimizely, umbraco, azure
Disciplines
security, engineering
Lifecycle
test-and-review, operate
Tags
  • owasp
  • owasp-top-10-2025
  • cve
  • nvd
  • dependency-scanning
  • nuget
  • npm
  • gdpr
  • ccpa
  • privacy
  • pii
  • consent-management
  • cookie-consent
  • security-headers
  • csp
  • hsts
  • penetration-testing
  • appsec
  • devsecops
  • remediation
  • client-reporting
  • dotnet
  • csharp
  • react
  • nextjs
Last updated
by Tyler Schroeder
Source
plugins/security-readiness-reviewer/

Edit this plugin's README on GitHub — opens GitHub's web editor. No git knowledge needed.