security-scanning
CI security scanning: secrets, deps, SAST, triage, expiring exceptions
How do I install this agent skill?
npx skills add https://github.com/bobmatnyc/claude-mpm-skills --skill security-scanningIs this agent skill safe to install?
- Gen Agent Trust Hubpass
This skill is a documentation-only resource providing guidelines and best practices for CI security scanning. It contains no executable code, malicious patterns, or suspicious external references.
- Socketpass
No alerts
- Snykpass
Risk: LOW · No issues
- Runlayerwarn
7/7 files flagged
What does this agent skill do?
Security Scanning
Quick Start
- Secrets: fail fast; rotate on exposure.
- Dependencies: gate critical/high; automate updates.
- SAST: start high-signal; ratchet over time.
- Open Source Safety: score components on three axes — license tier, severity-weighted CVEs, obsolescence.
- Exceptions: require reason, owner, and expiry.
Open Source Safety
Third-party component risk is more than "vulnerable: yes/no". Evaluate each component on three independent dimensions and gate on the worst:
- License risk: HIGH = strong copyleft / GPL/AGPL/LGPL (whole-app disclosure risk);
MEDIUM = weak copyleft / MPL, EPL (modification disclosure only); LOW = permissive /
MIT, Apache-2.0, BSD. Unknown/
NOASSERTION→ treat as HIGH until identified. - CVE weighting: weight by severity (critical ≫ high ≫ medium ≫ low) rather than raw counts; critical/high block, medium/low track with owner + expiry.
- Obsolescence: score the gap to latest version; majors-behind or unmaintained upstream is elevated risk.
See references/open-source-safety.md for the full framework, tier tables, the CVE
weighting model, obsolescence scoring, and the transitive-dependency trust model.
Load Next (References)
references/tooling-matrix.mdreferences/ci-workflows.mdreferences/triage-and-remediation.mdreferences/common-findings-and-fixes.mdreferences/supply-chain-and-sbom.mdreferences/open-source-safety.md
How can the creator link this skill?
Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.
<a href="https://skillzs.dev/skills/bobmatnyc/claude-mpm-skills/security-scanning">View security-scanning on skillZs</a>