skills.rest
FernanSuoza
FernanSuozaCOMMUNITY
Explore all skills by this author →
GitHub

sec-security-vulnerability-analysis

Scan dependencies, secrets, containers, and IaC for vulnerabilities.

Updated Mar 22, 2026
Search Tags:#vulnerability#remediation#ci-cd#triage#security-analysis#secret-scanning#dependency-scanning
One-click install
npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-security-vulnerability-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sec-security-vulnerability-analysis
Source: https://github.com/FernanSuoza/AIDD-project-bootstrap/tree/main/templates/skills/sec-security-vulnerability-analysis
Command: npx skills add https://github.com/FernanSuoza/AIDD-project-bootstrap --skill sec-security-vulnerability-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzes dependencies, secrets, filesystem, containers, and IaC to identify vulnerabilities.

Core Features & Use Cases

  • Dependency vulnerability scanning and secret exposure checks for secure code delivery.
  • Production-ready triage: convert findings into prioritized remediation stories and scanning guidance for CI/CD.
  • Use Case: When a repo ships multiple ecosystems, this skill inventories the surface areas and outputs a structured remediation plan.

Quick Start

Run vulnerability analysis against the target repository to generate a triaged remediation plan.

Frequently Asked Questions about sec-security-vulnerability-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan codebases for vulnerabilities across multi-language ecosystems?▼

To scan multi-language ecosystems for vulnerabilities, this skill inventories dependency, secret, filesystem, container, and IaC surfaces, then uses local scanning tools to identify exposures. It outputs a structured report with prioritized remediation guidance.

How does vulnerability triage work for CI/CD pipelines and releases?▼

Vulnerability triage for CI/CD pipelines works by converting scan findings into prioritized remediation stories and scanning guidance. It guides remediation across pull requests and releases to ensure secure code delivery.

Can I use OSV-Scanner, Gitleaks, and Trivy together for dependency and secret scanning?▼

Yes, you can use OSV-Scanner, Gitleaks, and Trivy together. This skill leverages these local scanning tools to execute dependency vulnerability checks and secret exposure detection across your codebase.

What is the best way to generate a remediation backlog from repository security findings?▼

The best way to generate a remediation backlog is to run a vulnerability analysis that inventories surface areas and applies triage decisions. It transforms raw security findings into an actionable, structured remediation plan.

Does this vulnerability analysis approach support infrastructure as code and container filesystems?▼

Yes, this vulnerability analysis supports infrastructure as code and container filesystems. It comprehensively analyzes dependencies, secrets, filesystems, containers, and IaC to identify potential security vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
florianbuetowflorianbuetow
12

integrity

Detects integrity vulnerabilities in code, CI/CD configs, and dependencies.

Community
Advanced
apacheapache
79

magpie-security-issue-sync

Synchronize security issues across GitHub, mailing lists, and pull requests.

Official
Advanced
xtrm-devxtrm-dev
4

security-pipeline

Bootstrap a GitHub security pipeline with secret scanning, SAST, and dependency checks.

Official
Advanced
mohitmishra786mohitmishra786

security

Scan code, dependencies, containers, and cloud configurations for security vulnerabilities.

Community
Advanced