forge-check-security

Name: forge-check-security
Availability: InStock
Author: moongci38-oss

Scan codebases for security vulnerabilities using a 15-phase model.

Updated Jun 3, 2026

Search Tags:#ci/cd #security audit #code security #owasp top 10 #vulnerability scanning

Ready to run

npx skills add https://github.com/moongci38-oss/forge-plugins --skill forge-check-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: forge-check-security
Source: https://github.com/moongci38-oss/forge-plugins/tree/main/forge-build/skills/forge-check-security
Command: npx skills add https://github.com/moongci38-oss/forge-plugins --skill forge-check-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires npm audit, pip-audit, pip, and includes scripts (resource) and assets (resource) components.

What problem does it solve?

This Skill automatically scans codebases for security vulnerabilities, providing comprehensive reports and triggering necessary gate checks during code development workflows.

Core Features & Use Cases

Comprehensive Security Audit: 15-phase audit covering OWASP Top 10, CI/CD, STRIDE model, exploit patterns, and trend tracking.
Integration: Automates QA phase 1 T6 (Security WARN gate) or can be manually triggered before PR creation.
Output Report: Generates a detailed security report with criticality levels and mitigation suggestions.

Quick Start

Run the 'forge-check-security' command in the root of your project directory.

Frequently Asked Questions about forge-check-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate code security scanning in a CI/CD pipeline?▼

Automate code security scanning by running the 'forge-check-security' command in your project root to enforce security gates and perform comprehensive vulnerability audits during your CI/CD workflow.

What does a 15-phase security audit cover for code vulnerabilities?▼

A 15-phase security audit covers OWASP Top 10 vulnerabilities, CI/CD pipeline risks, STRIDE threat modeling, exploit patterns, and trend tracking to identify critical, high, medium, and low risks.

How do I check my project for OWASP Top 10 vulnerabilities before a pull request?▼

Check for OWASP Top 10 vulnerabilities before a PR by manually triggering the security scan, which generates a detailed report with criticality levels and mitigation suggestions for identified risks.

Does the vulnerability scanning support both npm and pip dependencies?▼

The vulnerability scanning supports both npm and pip dependencies by utilizing 'npm audit' and 'pip-audit' to detect security issues within your codebase's dependency tree.

Can I enforce a security WARN gate automatically during the QA phase?▼

You can enforce a security WARN gate automatically during QA phase 1 T6 by integrating this scan into your pipeline, triggering necessary gate checks based on the generated vulnerability report.

What is the best way to generate a security report with mitigation suggestions for my codebase?▼

Generate a security report with mitigation suggestions by running a comprehensive 15-phase vulnerability scan, which outputs detailed criticality levels and actionable fixes for your application.