skills.rest
moongci38-oss
moongci38-ossCOMMUNITY
Explore all skills by this author →
GitHub

forge-check-security

Scan codebases for security vulnerabilities using a 15-phase model.

Updated Jun 3, 2026
Search Tags:#ci/cd#security audit#code security#owasp top 10#vulnerability scanning
One-click install
npx skills add https://github.com/moongci38-oss/forge-plugins --skill forge-check-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: forge-check-security
Source: https://github.com/moongci38-oss/forge-plugins/tree/main/forge-build/skills/forge-check-security
Command: npx skills add https://github.com/moongci38-oss/forge-plugins --skill forge-check-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires npm audit, pip-audit, pip, and includes scripts (resource) and assets (resource) components.

What problem does it solve?

This Skill automatically scans codebases for security vulnerabilities, providing comprehensive reports and triggering necessary gate checks during code development workflows.

Core Features & Use Cases

  • Comprehensive Security Audit: 15-phase audit covering OWASP Top 10, CI/CD, STRIDE model, exploit patterns, and trend tracking.
  • Integration: Automates QA phase 1 T6 (Security WARN gate) or can be manually triggered before PR creation.
  • Output Report: Generates a detailed security report with criticality levels and mitigation suggestions.

Quick Start

Run the 'forge-check-security' command in the root of your project directory.

Frequently Asked Questions about forge-check-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate code security scanning in a CI/CD pipeline?▼

Automate code security scanning by running the 'forge-check-security' command in your project root to enforce security gates and perform comprehensive vulnerability audits during your CI/CD workflow.

What does a 15-phase security audit cover for code vulnerabilities?▼

A 15-phase security audit covers OWASP Top 10 vulnerabilities, CI/CD pipeline risks, STRIDE threat modeling, exploit patterns, and trend tracking to identify critical, high, medium, and low risks.

How do I check my project for OWASP Top 10 vulnerabilities before a pull request?▼

Check for OWASP Top 10 vulnerabilities before a PR by manually triggering the security scan, which generates a detailed report with criticality levels and mitigation suggestions for identified risks.

Does the vulnerability scanning support both npm and pip dependencies?▼

The vulnerability scanning supports both npm and pip dependencies by utilizing 'npm audit' and 'pip-audit' to detect security issues within your codebase's dependency tree.

Can I enforce a security WARN gate automatically during the QA phase?▼

You can enforce a security WARN gate automatically during QA phase 1 T6 by integrating this scan into your pipeline, triggering necessary gate checks based on the generated vulnerability report.

What is the best way to generate a security report with mitigation suggestions for my codebase?▼

Generate a security report with mitigation suggestions by running a comprehensive 15-phase vulnerability scan, which outputs detailed criticality levels and actionable fixes for your application.

Related Skills

Explore More Software Engineering Skills→
V4-CompanyV4-Company
2

marsai:dev-dep-security-check

Audit dependency installations for identity, vulnerabilities, and lockfile integrity.

Official
Advanced
openxjarvisopenxjarvis
67

github

Automate GitHub issues, pull requests, and CI monitoring via the GitHub CLI.

Community
Intermediate
PriyanshKuniyalPriyanshKuniyal

sast-configuration

Configures and manages SAST tools for automated vulnerability detection in CI/CD pipelines.

Community
Advanced
UnitOneAIUnitOneAI
44

sast-config

Review and tune Semgrep and CodeQL SAST configurations against OWASP ASVS 4.0.3.

Official
Intermediate