skills.rest
camgrimsec
camgrimsecCOMMUNITY
Explore all skills by this author →
GitHub

devsecops-repo-analyzer

Performs end-to-end security analysis of GitHub repositories with automated reporting.

3|1|Updated Apr 13, 2026
Search Tags:#sast#threat-modeling#devsecops#sca#vulnerability-scanning#repository-audit#reachability-analysis
One-click install
npx skills add https://github.com/camgrimsec/grimsec-suite --skill devsecops-repo-analyzer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: devsecops-repo-analyzer
Source: https://github.com/camgrimsec/grimsec-suite/tree/main/agents/01-devsecops-repo-analyzer
Command: npx skills add https://github.com/camgrimsec/grimsec-suite --skill devsecops-repo-analyzer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires semgrep, trivy, grype, gitleaks, snyk, jinja2, tabulate, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

The DevSecOps Repo Analyzer reduces overwhelming, noisy scanner output by performing contextual, repository-specific analysis that identifies which vulnerabilities are actually reachable and exploitable in a codebase, then prioritizes and recommends remediation.

Core Features & Use Cases

  • 6-stage analysis pipeline: repo ingestion and inventory, application context & STRIDE threat modeling, multi-tool vulnerability scanning (SCA/SAST/IaC/secrets), reachability analysis, remediation recommendations (optional PR generation), and final assessment reporting.
  • Contextual risk scoring: assigns a Real Risk Score (1-10) per finding by combining reachability, exploitability, impact, and exposure to filter noise and focus developer effort.
  • Remediation-first output: produces structured artifacts (inventory.json, scan-results, reachability-analysis.json, remediation.json, assessment-report.md) and can generate GitHub PRs with a professional security PR template.
  • Use case: run a full DevSecOps assessment on a public or private GitHub repo to triage high/critical findings into actionable fixes and share a board-ready report with maintainers.

Quick Start

Run the devsecops-repo-analyzer on https://github.com/org/repo to produce a complete contextual security assessment and remediation artifacts.

Frequently Asked Questions about devsecops-repo-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reduce noise from vulnerability scanning and identify exploitable risks in my GitHub repository?▼

Repository vulnerability scanning identifies exploitable risks by performing reachability analysis on multi-tool SAST and SCA output. This approach assigns a contextual Real Risk Score to filter noise and prioritize actionable remediation for your GitHub codebase.

How do I run end-to-end DevSecOps threat modeling and scanning on a remote GitHub repository?▼

End-to-end DevSecOps analysis runs by applying a six-stage pipeline to a remote GitHub repository, performing inventory, STRIDE threat modeling, and multi-tool SAST, SCA, IaC, and secrets scanning to generate structured assessment reports and remediation artifacts.

Can I use Semgrep, Trivy, Grype, and Gitleaks together for a comprehensive repository security audit?▼

Yes, you can integrate Semgrep, Trivy, Grype, and Gitleaks for comprehensive repository security auditing. This combination executes SAST, SCA, IaC, and secrets scanning within a unified pipeline to produce consolidated scan-results and assessment reports.

What is reachability analysis in DevSecOps and how does it prioritize vulnerability remediation?▼

Reachability analysis in DevSecOps determines if identified vulnerabilities are actually exploitable within your specific codebase context. It calculates a Real Risk Score from one to ten by combining reachability, exploitability, impact, and exposure to prioritize remediation efforts.

Does this DevSecOps analysis pipeline generate automated remediation pull requests?▼

Yes, the DevSecOps analysis pipeline generates automated remediation pull requests. It uses a professional security PR template to output structured remediation.json artifacts and create actionable fixes directly on GitHub for high and critical findings.

What's the best way to generate a board-ready security assessment report from SAST and SCA scan results?▼

Generating a board-ready security assessment report involves consolidating SAST, SCA, and reachability analysis outputs into a final markdown file. This process transforms raw scan-results into structured inventory and remediation documents for repository maintainers.

Related Skills

Explore More Software Engineering Skills→
ancolemanancoleman
503

managing-vulnerabilities

Automate multi-layer security scanning and SBOM generation in CI/CD pipelines.

Community
Advanced
CloudChefCloudChef
15

cost-optimization

Analyze SmartCMP findings and execute native day2 remediations.

Official
Advanced
dpalferydpalfery

snyk-security

Scan projects for security vulnerabilities and code quality issues via Snyk MCP server.

Community
Advanced
jlawsjlaws
2

cmd-security-audit

Run STRIDE threat modeling and SAST vulnerability scans on codebases.

Community
Advanced