SkillsAdd

smithery/bobmatnyc

security-scanning

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

Installation

$ npx skills add smithery/bobmatnyc --skill security-scanning
View on skills.sh ↗ Website ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

firebase-security-rules-auditor Similar name
firebase/agent-skills

>- Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege esc…

111K installs
better-auth-security-best-practices Similar name
better-auth/skills

Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, s…

30.3K installs
firestore-security-rules-auditor Similar name
firebase/agent-skills 20.4K installs
security-review Similar name
getsentry/skills

Security code review for vulnerabilities.

15.5K installs
security-best-practices Similar name
openai/skills

Perform language and framework specific security best-practice reviews and suggest improvements…

8.2K installs
security-threat-model Similar name
openai/skills

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabili…

5.4K installs

Also in this package

Other skills from smithery/bobmatnyc · top by installs.

npx skills add smithery/bobmatnyc
vite 0 vercel-teams-billing 0 Test Quality Inspector 0 terraform 0 tauri 0 sveltekit 0 sqlalchemy 0 software-patterns 0 session-compression 0 sec-edgar-pipeline 0

Browse all from smithery/bobmatnyc

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Skill metadata

Parsed from SKILL.md frontmatter.

Version1.2.0
LicenseMIT
Compatibilityclaude-code
Declared agents claude-code
More metadata
version
1.2.0
category
universal
author
Claude MPM Team
updated
2026-06-15

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 1,925 B
  • docs SUMMARY.md 95 B

History

  1. First recorded snapshot · 0 installs

SKILL.md

Security Scanning

Quick Start

  • Secrets: fail fast; rotate on exposure.
  • Dependencies: gate critical/high; automate updates.
  • SAST: start high-signal; ratchet over time.
  • Open Source Safety: score components on three axes — license tier, severity-weighted CVEs, obsolescence.
  • Exceptions: require reason, owner, and expiry.

Open Source Safety

Third-party component risk is more than "vulnerable: yes/no". Evaluate each component on three independent dimensions and gate on the worst:

  • License risk: HIGH = strong copyleft / GPL/AGPL/LGPL (whole-app disclosure risk);

MEDIUM = weak copyleft / MPL, EPL (modification disclosure only); LOW = permissive / MIT, Apache-2.0, BSD. Unknown/NOASSERTION → treat as HIGH until identified.

  • CVE weighting: weight by severity (critical ≫ high ≫ medium ≫ low) rather than raw

counts; critical/high block, medium/low track with owner + expiry.

  • Obsolescence: score the gap to latest version; majors-behind or unmaintained

upstream is elevated risk.

See references/open-source-safety.md for the full framework, tier tables, the CVE weighting model, obsolescence scoring, and the transitive-dependency trust model.

Load Next (References)

  • references/tooling-matrix.md
  • references/ci-workflows.md
  • references/triage-and-remediation.md
  • references/common-findings-and-fixes.md
  • references/supply-chain-and-sbom.md
  • references/open-source-safety.md