Artifacts¶

---
name: asvc-report
description: Generate ASVC compliance audit reports with structured findings, risk ratings, and remediation guidance. Use when performing ASVC audits or generating compliance documentation.
---

# ASVC Report Generator

## Instructions

This skill generates comprehensive ASVC compliance audit reports.

### When to Use

- Performing ASVC compliance audits
- Documenting audit findings
- Generating executive summaries

### Workflow

1. Analyze target artifacts against ASVC controls
2. Document findings using the audit-finding prompt
3. Run the report generation script
4. Review and finalize the report

## Scripts

- `scripts/generate_report.py` — Generates formatted report from findings JSON
  - Usage: `python scripts/generate_report.py findings.json --output report.md`
  - Requires: Python 3.11+, Jinja2

## Templates

- `templates/report.j2` — Jinja2 template for report formatting

## References

- See [references/asvc-framework.md](references/asvc-framework.md) for ASVC control details
- See [references/severity-matrix.md](references/severity-matrix.md) for severity ratings

## Assets

- `assets/logo.png` — ASVC logo for report headers

You are an ASVC compliance auditor. Your role is to analyze codebases,
configurations, and documentation against ASVC framework requirements.

## Core Responsibilities

- Identify compliance gaps against ASVC standards
- Generate structured audit findings
- Produce executive summaries with risk ratings
- Recommend remediation actions

## Audit Process

1. **Analyze** — Review target artifacts against ASVC controls
2. **Map** — Map findings to ASVC control objectives
3. **Rate** — Assess severity (Critical / High / Medium / Low)
4. **Remediate** — Generate actionable remediation guidance

## Available Skills

You have access to the following skills:
- `asvc-report` — Generate ASVC audit reports
- `generic-auditor` — General-purpose code auditing

## Available Prompts

Use these prompts for structured output:
- `audit-finding` — Document a single audit finding
- `audit-summary` — Generate executive audit summary

## Output Format

All audit findings should follow the structured format defined in the
`audit-finding` prompt. Executive summaries should use the `audit-summary`
prompt format.

---
name: audit-finding
description: "Structured prompt for documenting a single audit finding"
variables:
  - name: control_id
    description: "ASVC control identifier"
    required: true
  - name: severity
    description: "Finding severity level"
    required: true
    enum: [critical, high, medium, low]
    default: medium
  - name: evidence
    description: "Evidence supporting the finding"
    required: false
    default: "No evidence provided"
---

# Audit Finding: {{control_id}}

## Severity: {{severity}}

Analyze the following evidence and produce a structured audit finding:

{{evidence}}

## Required Output Structure

1. **Finding Title**: Concise description of the issue
2. **Control Reference**: {{control_id}}
3. **Severity**: {{severity}}
4. **Description**: Detailed finding description
5. **Evidence**: Supporting evidence demonstrating the issue
6. **Impact**: Business/security impact of this finding
7. **Recommendation**: Actionable remediation steps with priority

## Example Finding

**Title**: Insufficient Input Validation on API Endpoints

**Control Reference**: {{control_id}}

**Severity**: {{severity}}

**Description**: The `/api/user` endpoint accepts unvalidated user input...

**Evidence**:
- File: `api/user.py`, Lines 45-67
- Missing input validation on `username` parameter
- Direct SQL query construction without sanitization

**Impact**: SQL injection vulnerability could lead to unauthorized data access...

**Recommendation**: Implement input validation using a validation library...

# {{title}}

Status: {{status}}

{{description}}

# Code Review Report

Status: complete

The code review identified 3 issues requiring attention...

---
name: asvc-coding-standards
description: "Coding standards for ASVC-compliant projects"
scope: project          # "project" (default) or "global"
globs: "**/*.py"        # Optional file pattern (used by Cursor rules)
---

# ASVC Coding Standards

## Security Requirements

- All API endpoints must validate authentication tokens
- Input validation required on all user-supplied data
- Secrets must never be committed — use environment variables
- All database queries must use parameterized statements

## Logging Requirements

- All security events must be logged with structured format
- Log entries must include: timestamp, user_id, action, resource, result
- Use the standard logging library with JSON formatter
- Sensitive data (tokens, passwords) must never be logged

## Error Handling

- Never expose internal error details to users
- Log full error details for debugging
- Return generic error messages to clients
- Use appropriate HTTP status codes

## Code Review Checklist

Before submitting code for review:

- [ ] All functions have docstrings
- [ ] Input validation on all external inputs
- [ ] Error handling for all external calls
- [ ] Unit tests with >80% coverage
- [ ] No secrets in code
- [ ] Logging for all security-relevant events

<!-- BEGIN AAM: asvc-coding-standards instruction -->
# ASVC Coding Standards

{{instruction contents}}
<!-- END AAM: asvc-coding-standards instruction -->