Clear-CapabilitiesOfficial·11 Agent Skills Included

agentic-security

Code security scanning, verified fixes, and compliance reporting

Scans codebases for vulnerabilities, leaked secrets, vulnerable dependencies, and insecure configurations across a dozen languages. Explains every finding in plain English with dollar-cost impact instead of raw CVE jargon, then applies fixes that are re-verified before touching disk. Generates SBOMs and compliance attestations for NIST, OWASP, and the EU AI Act, and blocks insecure code before it is written.

73|15

↗

npx skills add Clear-Capabilities/agentic-security --all -g -y

Available:

Gives the AI agent a map of the scanner's modules, build and test commands, and operational rules so it can route security tasks to the right component safely.

All Skills in This Repository (11)

Pure Emerald Level Indicators

📦 In Repo

Clear-Capabilities

agentic-security:add-scan-rule

Add a new SAST detector to the agentic-security scanner via a six-step process.

agentic-security:privacy-data-flow

Classify PII/PHI/PCI data flows and write DATA_FLOW.md artifacts.

agentic-security:security-sql-injection-warn

Block unsafe SQL string concatenation and enforce parameterized queries during code editing.

agentic-security:security-scan-on-deploy

Automate security scans before production deploys and surface top findings.

agentic-security:security-rotate-leak

Rotate leaked API keys and credentials end-to-end across supported providers.

agentic-security:security-fix-finding

Remediate a security finding via the MCP pipeline synthesize_fix, verify_fix, and apply_fix.

agentic-security:security-weak-crypto

Block code writes using MD5, SHA1, DES, RC4, or static IVs.

agentic-security:threat-model-first

Document STRIDE security risks before editing code across trust boundaries.

agentic-security:security-eval-warn

Detect and refuse runtime code-eval patterns across major languages.

agentic-security:security-explain-cve

Explain CVEs, GHSA findings, and scanner findings in plain English.

agentic-security:security-tutor

Explains security findings via Socratic Source-Sink-Sanitizer walkthroughs before remediation.

Official

Advanced

Frequently Asked Questions

FAQPage Schema

How to install agentic-security?▼

Run `npx skills add Clear-Capabilities/agentic-security --all -g -y` in your terminal to install all skills in this suite globally.

What does agentic-security scan for?▼

It detects code vulnerabilities, hardcoded secrets, vulnerable dependencies, insecure infrastructure configs, and prompt-injection risks across JavaScript, Python, Java, Go, Ruby, PHP, and more.

Can it fix vulnerabilities automatically?▼

Yes. It synthesizes a patch, re-scans and lints the fixed code, and only writes the change after verification passes, with a backup kept for rollback.

Does it work with Claude Code and other coding assistants?▼

Yes. It runs as a plugin in Claude Code and also works with Cursor, Codex, and Gemini CLI, plus IDE extensions for VS Code, JetBrains, and Neovim.

Can non-developers understand the scan results?▼

Yes. Every finding is explained in plain English with an estimated dollar cost of exploitation, so founders and product managers can make ship-or-fix decisions without security expertise.