skills.rest
Sheldon-92
Sheldon-92COMMUNITY
Explore all skills by this author →
GitHub

code-security

Orchestrate SAST, DAST, secret detection, and IaC security scanning into a prioritized triage plan.

3|Updated Sep 27, 2025
Search Tags:#security#sast#triage#risk-based#dast#kev#epss
One-click install
npx skills add https://github.com/Sheldon-92/TAD --skill code-security-sheldon-92
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-security
Source: https://github.com/Sheldon-92/TAD/tree/main/.agents/skills/code-security
Command: npx skills add https://github.com/Sheldon-92/TAD --skill code-security-sheldon-92

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jq, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill embeds a comprehensive security judgment framework across SAST, DAST, secret detection, IaC linting, and vulnerability triage to reduce risk and manual overhead in software development.

Core Features & Use Cases

  • SAST, DAST, secret-detection, IaC linting, and vulnerability triage rules assembled into a single, actionable pack for security teams.
  • Enables deterministic triage output with owner+deadline workflows and risk-based deadlines (KEV/BOD 26-04) mapped across findings.
  • Use cases include integrating into CI pipelines, pre-commit checks, and security gate configurations to shorten feedback loops while improving risk posture.

Quick Start

Invoke the code-security skill against your repository to generate a unified security triage plan and enforce risk-based remediation timelines.

Frequently Asked Questions about code-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate vulnerability triage with KEV and EPSS for my code repository?▼

Automate vulnerability triage by applying deterministic rules to aggregate KEV, EPSS, and reachability analyses, generating a prioritized triage plan with owner assignments and risk-based remediation deadlines mapped to BOD 26-04 requirements.

What is the best way to unify SAST, DAST, and IaC linting rules into a single pipeline?▼

Unify SAST, DAST, secret detection, and IaC linting by embedding a comprehensive security judgment framework into your CI pipelines and pre-commit checks, producing actionable triage output with owner and deadline workflows.

How do I enforce risk-based remediation deadlines for security findings in software projects?▼

Enforce risk-based remediation deadlines by orchestrating security scanning across code repositories and IaC configurations, applying BOD 26-04 deterministic rules to triage findings from KEV, EPSS, and reachability analyses into prioritized timelines.

Do I need jq installed to run code-security scanning and triage workflows?▼

Yes, you need jq installed as a required dependency to process and parse the JSON outputs from SAST, DAST, secret detection, and IaC linting tools, enabling deterministic triage plan generation.

Can I use this security triage configuration for pre-commit checks and security gates?▼

Yes, you can integrate this security triage configuration into pre-commit checks and security gate configurations to shorten feedback loops and improve risk posture across software development pipelines.

Related Skills

Explore More Software Engineering Skills→
kivo360kivo360
1

moai-domain-security

Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.

Community
Advanced
DCx7C5DCx7C5

endpoint-SKILL.md

Prioritize endpoint vulnerabilities using CVSS, EPSS, and CISA KEV signals.

Community
Advanced
matt-rileymatt-riley
1

secret-scan-triage

Classify gitleaks findings into confirmed secrets, probable secrets, or false positives.

Community
Intermediate
hung-phanhung-phan

vulnerability-management

Prioritize CVEs using CVSS, EPSS, KEV, and reachability analysis.

Community
Advanced