Run local security scanners mirroring CI-grade scans and gate on critical findings.
npx skills add https://github.com/xotong/claude-marketplace --skill appsec-scan
Please help me install this Agent Skill. Skill: appsec-scan Source: https://github.com/xotong/claude-marketplace/tree/main/plugins/appsec/skills/appsec-scan Command: npx skills add https://github.com/xotong/claude-marketplace --skill appsec-scan
Run the same security scanners as CI — locally, using identical container images — before pushing to GitLab. Covers Fortify SAST (Python and JS), Parasoft Jtest (Gradle and Maven), Pylint (SARIF output), ESLint (JSON output), Scantist SCA (JAR-based dependency analysis), and Trivy (container image scanning). Results go to .appsec-results/ and a severity-gated summary is printed at the end. Use when the user says: "appsec scan", "run security scanners", "run Fortify", "run Parasoft", "Scantist scan", "Trivy scan", "ESLint security", "Pylint scan", "pre-push security check", "CI security pipeline locally", "mirror CI scanners", "container security scan", "SCA scan", "SAST scan", "security before merge". Do NOT activate for general code review, unit testing, or lint-only requests.
High-intent search queries and answers about installing and using this skill.
To run CI security scanners locally, you can execute tools like Fortify, Parasoft, Trivy, and Scantist against your project to identify vulnerabilities before pushing. This mirrors your CI security pipeline locally and aggregates results into a severity-gated summary.
A pre-push security check runs SAST and SCA scanners like Pylint and ESLint on Python and JavaScript code to catch high or critical vulnerabilities early. It generates per-scanner results and a final severity gate that fails if critical issues are found.
Yes, local security scanning supports Java projects using Gradle and Maven through Parasoft Jtest. It orchestrates the execution of these SAST scanners alongside Python and JavaScript tools to provide aggregated vulnerability reports.
Yes, you can use Trivy for container image scanning as part of a local security scan. Trivy executes alongside SAST tools like Fortify and Scantist to provide comprehensive vulnerability coverage, with all results collected in a dedicated directory.
The best way to aggregate SAST and SCA scan results locally is to run multiple scanners in parallel and collect outputs in a single directory. This approach produces a unified severity-gated summary that fails on critical or high findings.
You should not use a local CI security pipeline for general code review, unit testing, or lint-only requests. It is specifically designed to execute CI-grade SAST, SCA, and container image security scans before pushing code to GitLab.
ANcpLuaConfigure Docker-based Testcontainers for .NET integration tests with xUnit v3.
igbuendAnalyze SARIF 2.1.0 files to generate vulnerability reports with CVSS scoring.
GDSDNRun pre-push quality checks on Git repositories before pushing.
d-padmanabhanAudit codebases with secrets scanning, SAST, SCA, and IaC validation.
