What problem does it solve? Hardcoded credentials, vulnerable Python packages, and unpinned CI actions can slip into Ansible collections and reach production or public repositories. This Skill scans code, dependencies, and CI workflows to surface these security issues before they are merged or released. ## Core Features & Use Cases - Secret Detection: Uses gitleaks to find hardcoded passwords, API keys, private keys, and cloud credentials in plugins, roles, playbooks, tests, and examples. - Dependency Auditing: Checks requirements.txt and pyproject.toml against known CVEs using pip-audit or safety, including a maintained list of vulnerable Ansible-ecosystem packages. - CI/CD Supply Chain Checks: Flags vulnerable or unpinned GitHub Actions versions and recommends pinning to commit SHAs. - Use Case: Before cutting a release of an Ansible collection, run the scan with the --fix flag to automatically update vulnerable dependencies and pin GitHub Actions, then review the structured severity-ranked report. ## Quick Start Ask the AI to run a security scan on this Ansible collection and report any hardcoded secrets or vulnerable dependencies.
