sec-security-vulnerability-analysis

Name: sec-security-vulnerability-analysis
Availability: InStock
Author: fernansuoza

Scan dependencies, secrets, containers, and IaC for vulnerabilities.

Updated Mar 22, 2026

Search Tags:#vulnerability #remediation #ci-cd #triage #security-analysis #secret-scanning #dependency-scanning

Ready to run

npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-security-vulnerability-analysis

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sec-security-vulnerability-analysis
Source: https://github.com/FernanSuoza/AIDD-project-bootstrap/tree/main/templates/skills/sec-security-vulnerability-analysis
Command: npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-security-vulnerability-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzes dependencies, secrets, filesystem, containers, and IaC to identify vulnerabilities.

Core Features & Use Cases

Dependency vulnerability scanning and secret exposure checks for secure code delivery.
Production-ready triage: convert findings into prioritized remediation stories and scanning guidance for CI/CD.
Use Case: When a repo ships multiple ecosystems, this skill inventories the surface areas and outputs a structured remediation plan.

Quick Start

Run vulnerability analysis against the target repository to generate a triaged remediation plan.

Frequently Asked Questions about sec-security-vulnerability-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan codebases for vulnerabilities across multi-language ecosystems?▼

To scan multi-language ecosystems for vulnerabilities, this skill inventories dependency, secret, filesystem, container, and IaC surfaces, then uses local scanning tools to identify exposures. It outputs a structured report with prioritized remediation guidance.

How does vulnerability triage work for CI/CD pipelines and releases?▼

Vulnerability triage for CI/CD pipelines works by converting scan findings into prioritized remediation stories and scanning guidance. It guides remediation across pull requests and releases to ensure secure code delivery.

Can I use OSV-Scanner, Gitleaks, and Trivy together for dependency and secret scanning?▼

Yes, you can use OSV-Scanner, Gitleaks, and Trivy together. This skill leverages these local scanning tools to execute dependency vulnerability checks and secret exposure detection across your codebase.

What is the best way to generate a remediation backlog from repository security findings?▼

The best way to generate a remediation backlog is to run a vulnerability analysis that inventories surface areas and applies triage decisions. It transforms raw security findings into an actionable, structured remediation plan.

Does this vulnerability analysis approach support infrastructure as code and container filesystems?▼

Yes, this vulnerability analysis supports infrastructure as code and container filesystems. It comprehensively analyzes dependencies, secrets, filesystems, containers, and IaC to identify potential security vulnerabilities.