Security and 152-FZ audit skill with rouble risk pricing
axioma-security
A skill for a deep website security and 152-FZ compliance audit: every finding is mapped to a law article and priced in roubles
- 0 ★ on the repository
- Last commit
Extended access
Why this level
- Active testing can affect a live site and requires the owner's written authorization
- Fine and risk estimates do not replace a legal opinion before filing with Roskomnadzor
Install
- Works in
- Services
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/axioma-securityDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Active testing can affect a live site and requires the owner's written authorization
- Fine and risk estimates do not replace a legal opinion before filing with Roskomnadzor
This is third-party code. Review the repository files before installing.
What it does
The skill walks the agent through eight audit phases, each closed with an artifact: prep and written test authorization (without it, the skill switches to a passive, documentary-only audit), passive recon (OSINT, DNS, subdomains, subdomain takeover, SPF/DKIM/DMARC, leaked data), transport and headers (TLS, CORS, cookies), an OWASP application check (injections, XSS, IDOR, JWT/OAuth, SSRF), personal-data handling review, 152-FZ compliance (consents, localization, cross-border transfer, FSTEC and FSB threat modeling), deterministic risk pricing (a likelihood multiplier times the midpoint of the fine range plus other damage, P0-P2 priority), and a final report with a findings registry and remediation plan. The sanctions reference under the Administrative Code, Criminal Code and 152-FZ lives in a separate file and is checked against the report date.
Who it is for. For security specialists and site owners who need a report that reads clearly for an engineer, a lawyer, and a business owner alike.
Good fit when
- You need a security audit that maps every finding to a specific law article and fine amount
- You have written authorization from the resource owner for active testing
- You need a rouble risk estimate to prioritize fixes (P0-P2)
Not a fit when
- You have no written owner authorization for active testing: the skill will limit itself to a passive audit, and active pentesting without authorization is illegal (Criminal Code art. 272)
- You need a legal opinion for a court or Roskomnadzor: the sanctions reference needs verification against the current law before operational use
Example request
Run a security and 152-FZ audit of example.ru, I have written owner authorizationLimitations
Active testing requires written authorization from the resource owner, otherwise the skill falls back to a passive audit. The sanctions reference is current as of the date in the file (September 2026) and needs verification before an operational report. Risk pricing is a deterministic formula, not an individualized legal assessment.
How to disable. Delete the skills/axioma-security folder from ~/.claude/skills.
FAQ
Can the skill be used without the site owner's permission?
Active testing only happens with written authorization (Criminal Code art. 272); without it, the skill switches to a passive, documentary-only audit.
How is the risk cost calculated?
A likelihood multiplier (0.7 / 0.4 / 0.1) is multiplied by the midpoint of the fine range and added to other damage, and the result drives the P0-P2 priority.
Discussion
No questions or reviews yet.
Related
All Russian law tools152-FZ website audit skill
audit-152fz
A Claude skill that audits a website and its documents against Federal Law 152-FZ using a 55-point checklist, with fine estimates and a fix plan
A skill that checks a website against Russian law: personal data, cookies and trackers, operator details, advertising and login methods
152-FZ personal data audit
152fz-data-audit-skill
A 152-FZ personal data audit skill: where the database lives, what leaves Russia, who really has access and what never gets deleted
An evidence-based SEO audit skill using signals from the Google Content Warehouse API leak, plus a Russian 152-FZ and Roskomnadzor launch checklist
A first-pass contract review skill under Russian law: Civil Code, 152-FZ, Roskomnadzor, personal data
Russian supply contract review skill
Russian Legal Skills для Claude
A Claude Skill that reviews a Russian supply contract under Civil Code chapter 30: essential terms, deadlines, price and liability
README in short
The bilingual README explains why a merged security and 152-FZ report is needed: a normal pentest does not state cost or the law, a normal compliance audit does not check whether data can actually leak. It describes the eight phases with artifacts, the risk-pricing formula, the skill's three files (operational guide, a 17-section methodology, a sanctions reference), and an explicit boundary on authorization for active testing.