feat(claude-skills): add complyos-security-review skill

[dkramer-sevenbelow]

Summary

• Adds complyos-security-review Claude Skill under claude-setups/claude-skills/
• Evidence-backed, 15-phase security review for multi-tenant SaaS platforms
• Covers OWASP Top 10:2021, ASVS L2, OWASP API Top 10:2023, OWASP LLM Top 10:2025 + Agentic AI 2026, tenant isolation, RLS, evidence/document storage, CI/CD + supply chain, cloud/IaC

What it does

Drives Claude through 15 phases (scope → threat model → AuthN → AuthZ → tenant isolation → API → data/evidence → AI/RAG → secrets → CI/CD → cloud → logging → test gaps → findings register → remediation plan), producing structured artifacts with file/line evidence on every claim.

Hard rules enforced by the skill:

• No PASS without implementation evidence (spec text rejected as evidence)
• No finding without attack path + smallest-safe-fix + regression test
• Tenant-isolation breaches default to Critical
• Status separation: CONFIRMED / LIKELY / STATIC-ONLY / NEEDS-RUNTIME-TEST / BLOCKED
• No runtime tests against deployed envs without explicit scope-doc authorization
• No secret values read, printed, or written

Layout

claude-setups/claude-skills/complyos-security-review/
├── README.md                                 # branded install + usage docs
├── SKILL.md                                  # operating contract
├── checklists/                               # 10 domain checklists
│   ├── owasp-top-10.md
│   ├── owasp-asvs-l2.md
│   ├── owasp-api-security.md
│   ├── owasp-llm-security.md
│   ├── tenant-isolation.md
│   ├── authn-authz.md
│   ├── data-evidence-security.md
│   ├── cicd-supply-chain.md
│   ├── cloud-iac.md
│   └── ai-rag-security.md
├── templates/                                # 6 artifact templates
│   ├── finding-template.md
│   ├── findings-register-template.md
│   ├── scope-template.md
│   ├── threat-model-template.md
│   ├── remediation-plan-template.md
│   └── test-plan-template.md
└── examples/
    ├── usage-prompt.md
    └── review-command.md

Public-repo safety

Scrubbed before commit:

• Internal hostnames (replaced with <api-domain> / <ui-domain> placeholders)
• Internal repo names (replaced with <api-service> / <agent-service> / <ui-service> / <iac-root> / <iac-metadata> / <library-tools>)
• Internal role IDs (replaced with generic PLATFORM_ADMIN)
• Jira project keys (replaced with generic JIRA-NNN)
• Internal documentation paths (replaced with generic docs/specs/... / docs/security-review/...)
• No vault item names, no secret references, no PII, no customer names

Test plan

• Verify install path: cp -r claude-setups/claude-skills/complyos-security-review ~/.claude/skills/
• Verify Claude Code picks up skill: /reload-plugins then check slash-command picker
• Trigger via /complyos-security-review — confirm skill loads, requests scope inputs
• Trigger via natural-language phrase ("security review") — confirm auto-invocation
• Trigger Phase 0 only (scope-gap mode) — confirm halt on missing inputs
• Run dry-pass against a small target repo, confirm artifact files written under chosen output root
• Verify symlink install variant works (active-development pattern in README)
• Sparse-clone install path verified per README

Notes

• README links complyos.app and sevenbelow.com as branded references; no internal infra URLs.
• LICENSE inherited from repo root.
• Companion skills referenced in examples/usage-prompt.md (compliance-os-api-standard, hard-isolation-migration-checklist, owasp-security, precheck) are private to internal workspace; not shipped here.

🤖 Generated with Claude Code