skills.rest
akoita
akoitaCOMMUNITY
Explore all skills by this author →
𝕏@aboobakarGitHub

security-scan

Runs free deterministic security scanners and normalizes their output into one SARIF digest.

Updated Jul 9, 2026
Search Tags:#sast#security scanning#secrets detection#sca#sarif#ci pipeline#vulnerability triage
One-click install
npx skills add https://github.com/akoita/agent-toolkit --skill security-scan-akoita
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/akoita/agent-toolkit/tree/main/plugins/claude/security/skills/security-scan
Command: npx skills add https://github.com/akoita/agent-toolkit --skill security-scan-akoita

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Wiring SAST, SCA, secrets, IaC, and DAST scanners into pre-commit hooks and CI pipelines is error-prone: every tool has different install steps, exit codes, suppression syntax, and output formats, and a naive gate misreports clean scans as failures. This Skill provides the decision procedure for choosing, invoking, sequencing, and gating a free deterministic security toolchain. ## Core Features & Use Cases - Stack detection and tool selection: Detects languages, IaC, CI workflows, and smart contracts from manifests, then picks defaults like opengrep for SAST, osv-scanner for dependencies, gitleaks for secrets, and trivy config for infrastructure. - Exit-code and suppression handling: Ships a per-tool exit-code table (e.g., osv-scanner 128 means no packages found, trufflehog exits 183 on verified secrets) and suppression syntax cheat sheet so gating logic is correct. - SARIF normalization and triage: Collapses multi-tool output with sarif-tools, deduplicates findings by (file, line, CWE), and ranks CVEs using CISA KEV and EPSS rather than CVSS alone. - Use Case: When adding security scanning to a repository's pull-request CI, use this Skill to run diff-scoped opengrep and osv-scanner, block only new HIGH and CRITICAL findings, and land new checks advisory-first per the ratchet rule. ## Quick Start Ask the agent to set up and run the free security scanning toolchain for this repository and wire the appropriate checks into pre-commit and pull-request CI.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add security scanning to a CI pipeline?▼

Detect the stack from manifest files, then run diff-scoped SAST with opengrep, osv-scanner on dependencies, and trivy config on changed infrastructure in pull-request CI. Block only on new HIGH and CRITICAL findings, and land new checks with continue-on-error for two to four weeks before promoting them to required.

What free SAST tool should I use instead of Semgrep?▼

Use opengrep, an LGPL-2.1 self-contained binary with cross-function taint analysis and no login requirement. Semgrep registry rules are licensed for internal business purposes only and cannot be redistributed, while opengrep rule packs are MIT or Commons-Clause redistributable.

Why does my security scan pass in CI but find nothing?▼

osv-scanner exits 128 when no packages are found, meaning the scan did nothing, and trivy exits 0 on findings unless --exit-code is passed. Capture each tool's exit code explicitly and compare it against the documented table instead of using a generic nonzero check.

How do I suppress false positives in security scanners?▼

Prefer tuning the rule first, then allowlisting the path, then baselining, and only then an inline suppression with a mandatory justification, such as // nosemgrep: rule-id or #checkov:skip=CKV_AWS_20:reason. Always name the specific rule, since a bare suppression disables every rule on the line.

How should I prioritize CVEs found by dependency scanning?▼

Rank by exploitation evidence rather than CVSS alone: anything in the CISA KEV catalog is P0, EPSS >= 0.1 with CVSS >= 7 is P1, CVSS >= 9 alone is P2, and the rest is backlog. Never gate a build on an unfixable transitive vulnerability.

When should I not use this deterministic scanning skill?▼

Use security-review for reasoning about a diff, security-audit for a judgment-driven repository audit, and the dedicated skills for supply-chain, threat-model, smart-contract, or AI-system questions. This skill covers choosing, invoking, and gating scanner tools only.

Related Skills

Explore More Software Engineering Skills→
FernanSuozaFernanSuoza

sec-security-vulnerability-analysis

Scan dependencies, secrets, containers, and IaC for vulnerabilities.

Community
Advanced
dreadnodedreadnode
11

attack-path-triage

Prioritize BloodHound Enterprise attack-path findings by severity and blast radius.

Official
Intermediate
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced
EntroVyxEntroVyx
3

hunt-cors

Validate CORS misconfigurations for unauthorized credentialed access to sensitive data.

Community
Advanced