skills.rest
paulingham
paulinghamCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-alert-fix

Automate investigation and remediation of open GitHub CodeQL and secret-scanning alerts.

1|Updated Mar 15, 2026
Search Tags:#automation#workflow#security#github#alerts#code-scanning#secret-scanning
One-click install
npx skills add https://github.com/paulingham/.claude --skill security-alert-fix
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-alert-fix
Source: https://github.com/paulingham/.claude/tree/main/skills/security-alert-fix
Command: npx skills add https://github.com/paulingham/.claude --skill security-alert-fix

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security engineers and developers quickly enumerate open CodeQL and secret-scanning alerts, group them by rule, and apply proper fixes through the pipeline, while ensuring revocation actions are surfaced for secrets.

Core Features & Use Cases

  • Enumerate open alerts from code-scanning, secret-scanning, and dependabot
  • Group alerts by rule and apply fixes via the pipeline
  • Surface secret revocation as a required manual action and avoid re-introducing secrets

Quick Start

Run the security-alert-fix workflow against your repository to enumerate open alerts and apply fixes.

Frequently Asked Questions about security-alert-fix

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate fixing GitHub security alerts like CodeQL and secret scanning?▼

Automate fixing GitHub security alerts by running a workflow that enumerates open CodeQL and secret-scanning alerts, groups them by rule, and applies fixes directly through the standard pipeline.

What is the best way to triage multiple open CodeQL alerts in a repository?▼

Triage open CodeQL alerts by grouping them by rule, which allows you to apply pipeline-driven fixes systematically across the repository without manually addressing each individual alert.

Does this workflow handle secret revocation automatically?▼

Secret revocation is not automated; the workflow surfaces secret revocation as a required manual action and avoids re-introducing secrets while applying fixes through the pipeline.

Can I use this to fix Dependabot alerts and code scanning vulnerabilities together?▼

Yes, you can fix Dependabot alerts and code scanning vulnerabilities together by enumerating open alerts from code-scanning, secret-scanning, and Dependabot, then applying fixes via the pipeline.

Why does the workflow avoid suppressions when remediating CodeQL alerts?▼

Suppressions are avoided to ensure proper remediation of CodeQL alerts by applying actual fixes through the pipeline, maintaining security integrity rather than hiding detected vulnerabilities.

How do I group GitHub security alerts by rule for pipeline-driven fixes?▼

Group GitHub security alerts by rule by running the security-alert-fix workflow against your repository, which automatically enumerates and categorizes alerts to apply fixes efficiently.

Related Skills

Explore More Software Engineering Skills→
L3DigitalNetL3DigitalNet
6

security

Audit GitHub repository security via Dependabot, code scanning, and branch protection.

Official
Advanced
mrkhachaturovmrkhachaturov

cso

Audit dependencies, CI/CD configurations, and webhooks to generate a security posture report.

Community
Advanced
pluginagentmarketplacepluginagentmarketplace
1

github-features

Manage GitHub pull requests, issues, actions, and projects via CLI.

Community
Advanced
brainbrewlabsbrainbrewlabs
7

code-fixing

Fix code scanner, security auditor, and linter issues with verified edits and reports.

Official
Intermediate