skills.rest
open-mercato
open-mercatoOFFICIAL
Explore all skills by this author →
WebsiteGitHub

om-auto-sec-report

Aggregates per-unit security analyses across merged PRs into one docs-only report PR.

1.7k|382|Updated Sep 10, 2025
Search Tags:#owasp#audit#aggregation#security report#gitHub#Code review#Pull request
One-click install
npx skills add https://github.com/open-mercato/open-mercato --skill om-auto-sec-report
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: om-auto-sec-report
Source: https://github.com/open-mercato/open-mercato/tree/main/.ai/skills/om-auto-sec-report
Command: npx skills add https://github.com/open-mercato/open-mercato --skill om-auto-sec-report

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reviewing security posture across many merged pull requests one at a time is slow and easy to skip. This Skill automates the batch analysis by looping a single-unit security review skill over a window of work (a date range, PR-number floor, branch, or spec) and consolidating every finding into one aggregated markdown and HTML report delivered as a docs-only PR against develop.

Core Features & Use Cases

  • Window-based batching: Analyze all PRs merged since a date, above a PR number, or default to the last 7 days of merged PRs, with --max-units caps and --include-open support.
  • Delegated per-unit analysis: Invokes om-auto-sec-report-pr for each unit with --out-fragment, then concatenates fragments verbatim into .ai/analysis/auto-sec-report-{DATE}.md plus an HTML mirror.
  • Consolidated reporting: Produces an executive summary, OWASP risk heatmap, paranoid-vector coverage matrix, and a deduplicated "Next steps — go deeper" list with exactly one [recommended] follow-up.
  • Resumable orchestration: Tracks progress in a plan file with per-unit checkboxes and commit SHAs, hands off to om-auto-continue-pr when a run cannot finish in one invocation.
  • Use Case: After a sprint, run the driver with no arguments to audit the last 7 days of merged PRs and receive a single PR containing the full security report, labeled review, documentation, security, and skip-qa.

Quick Start

Run the auto security report driver with no arguments to analyze the last 7 days of merged PRs and open an aggregated docs-only report PR against develop.

Frequently Asked Questions about om-auto-sec-report

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review across multiple merged pull requests?▼

Invoke the driver with a date (YYYY-MM-DD), a PR-number floor, or no argument to default to the last 7 days of merged PRs. It queues each unit, runs the per-unit analysis skill on each, and opens one aggregated docs-only PR against develop.

What does the aggregated security report contain?▼

The report includes an executive summary with finding counts by severity, an OWASP A01-A10 risk heatmap, a paranoid-vector coverage matrix, verbatim per-unit fragments, and a deduplicated Next steps list with one recommended follow-up. It is written as markdown and HTML under .ai/analysis/.

Can I analyze a single branch or spec instead of merged PRs?▼

Yes. Passing a branch name or a spec path under .ai/specs/ creates a single-entry queue, and the driver still produces the full aggregate report layout. Branch and spec inputs are first-class window types.

What happens if the batch security run cannot finish in one invocation?▼

The driver leaves Status: in-progress in the PR body, keeps per-unit progress checkboxes with commit SHAs, and posts a hand-off comment directing you to resume with /auto-continue-pr. Partial or skipped units are recorded inline without aborting the batch.

Does the security report ever include secrets or sensitive data?▼

No. The skill forbids pasting raw diffs, secrets, tokens, .env content, credentials, internal hostnames, or user PII, redacting them to {REDACTED}. A secret-leak grep and link validation run before any commit.

Related Skills

Explore More Software Engineering Skills→
zizzfizzixzizzfizzix

auto-sec-report

Aggregate security findings from merged pull requests into markdown and HTML reports.

Community
Advanced
nmoralescybernmoralescyber

ticket-triage

Categorize, prioritize, and route inbound support tickets with P1-P4 priority.

Community
Intermediate
NikitaDmitrieffNikitaDmitrieff
39

code-review-security

Identifies and remediates security vulnerabilities in Python (FastAPI) and React code via AST and regex scans, outputting findings to security-review.md.

Community
Advanced
freire19freire19

security-audit

Audit codebases for vulnerabilities, insecure configurations, and dependency CVEs.

Community
Intermediate