skills.rest
psmfd
psmfdOFFICIAL
Explore all skills by this author →
GitHub

checkmarx-expert

Provides Checkmarx One CLI reference for SAST, SCA, IaC, and secrets scanning workflows.

Updated Jun 24, 2026
Search Tags:#ci/cd#cli#sast#security scanning#sca#iac security#checkmarx
One-click install
npx skills add https://github.com/psmfd/pi-config --skill checkmarx-expert-psmfd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: checkmarx-expert
Source: https://github.com/psmfd/pi-config/tree/main/agent/skills/checkmarx-expert
Command: npx skills add https://github.com/psmfd/pi-config --skill checkmarx-expert-psmfd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security engineers and developers often struggle to remember the correct Checkmarx One CLI syntax, authentication options, scan configurations, and CI/CD integration patterns, leading to misconfigured scans and broken pipelines. ## Core Features & Use Cases - CLI Command Reference: Covers scan creation, results retrieval, triage updates, thresholds, and exit codes for the cx binary across Linux, macOS, and Windows. - Authentication & Configuration Guidance: Documents API key and OAuth client setup, regional base URLs, environment variables, and config-as-code via .checkmarx/config.yml. - CI/CD Integration: Provides ready patterns for GitHub Actions and Azure DevOps, including SARIF upload and break-build thresholds. - Use Case: A DevOps engineer adding security gates to a pipeline can look up the exact cx scan create flags, threshold syntax like sast-high=0, and SARIF reporting options without leaving the terminal. ## Quick Start Ask the checkmarx-expert subagent how to create and run a Checkmarx One SAST and SCA scan on the current project with a high-severity threshold.

Frequently Asked Questions about checkmarx-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a Checkmarx One scan from the command line?▼

Run cx scan create with the source path, project name, and branch, for example cx scan create -s . --project-name myapp --branch main. Authenticate with --apikey or an OAuth client ID and secret, and select scanners with --scan-types sast,sca,iac-security.

How to scan code with Checkmarx without an account?▼

Use cx scan sca-realtime -p /path/to/project for a free local SCA scan or cx scan kics-realtime --file file.tf for IaC scanning via Docker or Podman. Neither requires authentication, and results are returned as JSON to stdout.

What is the difference between Checkmarx API key and OAuth client authentication?▼

API keys are simpler and inherit the generating user's permissions, but expire in 30-365 days and are invalidated by license changes. OAuth clients offer granular permissions and are created under Settings > IAM > OAuth Clients in the portal.

Does Checkmarx One CLI integrate with GitHub Actions?▼

Yes, use the official checkmarx/ast-github-action with tenant, client ID, and client secret stored as GitHub secrets. Add --report-format sarif to additional_params and upload results with github/codeql-action/upload-sarif for GitHub Security integration.

Why is local Checkmarx SCA scanning a security risk?▼

Local SCA resolution invokes package managers like npm, pip, and gradle, which can execute arbitrary code from malicious build files such as lifecycle scripts. Prefer cloud-based cx scan create --scan-types sca, or sandbox local scans in hardened containers.

How do I fail a build based on Checkmarx scan severity?▼

Pass --threshold with the format engine-severity=count, for example --threshold "sast-high=10; sca-high=5". Thresholds use OR logic, so breaching any single threshold fails the build with a non-zero exit code.

Related Skills

Explore More Software Engineering Skills→
louzhengshuailouzhengshuai

deepscientist-windows-wsl-setup

Set up DeepScientist on Windows with WSL2 and Codex authentication.

Community
Advanced
edercnjedercnj

x-scan-container-security

Scan Docker images and Dockerfiles for vulnerabilities and generate SARIF reports.

Community
Advanced
AcczdyAcczdy
2

implementing-devsecops-security-scanning

Automate SAST, DAST, and SCA security scanning across CI/CD pipelines.

Community
Advanced
HouseGarofaloHouseGarofalo
3

security-scanner

Scan container images, dependencies, and IaC for security vulnerabilities.

Official
Advanced