skills.rest
ThiagoGuislotti
ThiagoGuislottiCOMMUNITY
Explore all skills by this author →
GitHub

sec-security-vulnerability-engineer

Audits and remediates .NET, npm/pnpm/yarn, and Rust dependency vulnerabilities with severity-based enforcement and reports.

2|1|Updated Sep 11, 2025
Search Tags:#npm#rust#dotnet#dependency-management#sca#security-gates#vulnerability-audit
One-click install
npx skills add https://github.com/ThiagoGuislotti/copilot-instructions --skill sec-security-vulnerability-engineer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sec-security-vulnerability-engineer
Source: https://github.com/ThiagoGuislotti/copilot-instructions/tree/main/.codex/skills/sec-security-vulnerability-engineer
Command: npx skills add https://github.com/ThiagoGuislotti/copilot-instructions --skill sec-security-vulnerability-engineer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Many repositories span multiple ecosystems and lack consistent SCA (software composition analysis) checks, leaving critical and high-severity dependency vulnerabilities undetected before build or release. This Skill reduces release risk by systematically auditing dependencies, enforcing severity-based quality gates, and guiding minimal, safe remediations.

Core Features & Use Cases

  • Cross-stack vulnerability audits for .NET backends, frontend projects using npm/pnpm/yarn, and Rust crates.
  • Severity classification & policy enforcement to fail pipelines or block releases based on configurable thresholds (e.g., Critical, High).
  • Minimal safe remediation that proposes targeted upgrades or patches, reruns audits, and reports residual risk and artifacts.
  • Use Case: Run a pre-release security gate that audits all packages, blocks the pipeline on critical/high findings, applies vetted upgrades, and produces a remediation summary for the release notes.

Quick Start

Run a cross-stack dependency vulnerability audit across the repository, classify findings by severity, enforce fail-on Critical,High, apply minimal safe upgrades, and produce a remediation report.

Frequently Asked Questions about sec-security-vulnerability-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm, .NET, and Rust dependencies for vulnerabilities before a release?▼

Cross-stack dependency vulnerability audits scan npm, .NET, and Rust codebases to classify findings by severity. This process reduces release risk by detecting critical and high-severity package vulnerabilities before build or release deployment.

Can I enforce security gates that block pipelines based on vulnerability severity?▼

Yes, you can enforce security gates by configuring fail-on thresholds for severity levels like Critical and High. Pipelines or releases are automatically blocked if dependency vulnerability audits detect findings that exceed these configured severity thresholds.

What is the best way to remediate software composition analysis findings without breaking changes?▼

Minimal safe remediation proposes targeted dependency upgrades or patches to resolve software composition analysis findings. After applying vetted upgrades, the system reruns audits and tests to verify safety and reports any residual risk artifacts.

Does this dependency vulnerability audit work with pnpm and yarn frontend projects?▼

Dependency vulnerability audits work with frontend projects using npm, pnpm, and yarn package managers. The software composition analysis also supports .NET backends and Rust crates, providing consistent cross-stack vulnerability detection and remediation.

How do I generate a remediation report after applying safe dependency upgrades?▼

After applying minimal safe upgrades and rerunning audits, a remediation report is produced automatically. This report summarizes the resolved dependency vulnerabilities, documents residual risk, and generates artifacts suitable for inclusion in release notes.

When should I not use automated minimal safe upgrades for vulnerability remediation?▼

Automated minimal safe upgrades should be used cautiously when complex dependency conflicts exist across npm, .NET, or Rust ecosystems. Always review the generated residual risk artifacts and remediation reports to ensure the targeted patches do not introduce breaking changes.

Related Skills

Explore More Software Engineering Skills→
thatrebeccaraethatrebeccarae
97

dep-audit

Scan Node.js, Python, Rust, and Go manifests for outdated packages, advisories, and license issues.

Community
Advanced
chrislyonschrislyons

git.release.prep

Automates release prep with semantic versioning, changelog generation, and GitHub publishing.

Community
Intermediate
do360nowdo360now

sbom-analysis

Analyzes SBOM files for format, metadata completeness, dependency risks, and license conflicts.

Community
Intermediate
o2b3ko2b3k

aif-security-checklist

Audit source code for injection, XSS, and hardcoded secrets.

Community
Advanced