goat-security

Name: goat-security
Availability: InStock
Author: blundergoat

Assesses code security threats via structured analysis and vulnerability scanning for PRs and CI/CD audits.

Updated Feb 19, 2026

Search Tags:#security #threat-modeling #devsecops #supply-chain #code-review #vulnerability-assessment

Ready to run

npx skills add https://github.com/blundergoat/ambient-scribe --skill goat-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: goat-security
Source: https://github.com/blundergoat/ambient-scribe/tree/main/.agents/skills/goat-security
Command: npx skills add https://github.com/blundergoat/ambient-scribe --skill goat-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill provides a structured, repeatable framework for assessing the security posture of codebases, PRs, and agent surfaces, preventing the oversight of critical vulnerabilities during development.

Core Features & Use Cases

Threat Surface Analysis: Automatically identifies high-risk areas like auth/authz, file uploads, and CI/CD workflows.
Evidence-Based Reporting: Categorizes findings into confirmed, probable, or theoretical threats with clear entry-to-sink paths.
Use Case: Before merging a PR that modifies authentication logic, use this skill to perform a full assessment to ensure no new exploit paths are introduced.

Quick Start

Use the goat-security skill to perform a quick scan of the current repository to identify potential security vulnerabilities.

Frequently Asked Questions about goat-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a threat modeling assessment on a pull request?▼

To perform threat modeling on a pull request, assess security implications by verifying trust boundaries and entry-to-sink paths to ensure modified authentication logic introduces no new exploit paths. This structured assessment categorizes findings into confirmed, probable, or theoretical threats.

What is automated threat surface analysis for CI/CD pipelines?▼

Automated threat surface analysis identifies high-risk areas in CI/CD pipelines, such as workflows and file uploads. It systematically verifies trust boundaries and framework-level mitigations to evaluate the security posture of software projects during pipeline audits.

How do I scan a repository for security vulnerabilities before merging?▼

Scan your repository for security vulnerabilities by performing a systematic vulnerability assessment of code changes. This process maps entry-to-sink paths and categorizes discovered threats into confirmed, probable, or theoretical findings before merging.

Can I use automated vulnerability scanning for architecture decisions?▼

Yes, you can use automated vulnerability scanning to assess the security implications of architecture decisions. The assessment evaluates agent surfaces and applies structured threat modeling to verify framework-level mitigations and trust boundaries.

What is the best way to audit CI/CD workflows for supply chain threats?▼

The best way to audit CI/CD workflows for supply chain threats is through structured threat modeling that identifies high-risk workflow areas. This security posture evaluation verifies trust boundaries and framework-level mitigations to map potential entry-to-sink exploit paths.