skills.rest
Cornjebus
CornjebusCOMMUNITY
Explore all skills by this author →
GitHub

security-analyzer

Analyze codebase and infrastructure security vulnerabilities with CVE data and remediation plans.

7|Updated Dec 7, 2025
Search Tags:#code analysis#security#vulnerability#remediation#CVE#container security#devsecops
One-click install
npx skills add https://github.com/Cornjebus/security-analyzer --skill security-analyzer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-analyzer
Source: https://github.com/Cornjebus/security-analyzer/tree/main/.claude/skills/security-analyzer
Command: npx skills add https://github.com/Cornjebus/security-analyzer --skill security-analyzer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill eliminates the tedious, manual work of identifying and remediating security vulnerabilities across your codebase and infrastructure. It provides a comprehensive, automated solution to proactively protect your projects, saving you countless hours and reducing the risk of critical security breaches.

Core Features & Use Cases

  • Automated Vulnerability Scanning: Scans dependencies (npm, pip, go), containers (Docker, Kubernetes), and cloud IaC (Terraform, CloudFormation) for known CVEs and misconfigurations.
  • Risk-Prioritized Remediation: Generates phased remediation plans with actual fix commands and TDD validation tests, ensuring critical issues are addressed first.
  • Dual Reporting: Produces detailed technical reports for engineers and concise executive summaries for leadership, streamlining communication and decision-making.
  • Use Case: Imagine you've just inherited a complex microservices project. Use this Skill to instantly get a full security posture assessment, complete with prioritized fixes and tests, allowing you to secure the project without spending weeks on manual analysis.

Quick Start

Run a comprehensive security scan on this project and generate reports.

Frequently Asked Questions about security-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for security vulnerabilities and CVEs?▼

Automated vulnerability scanning analyzes dependencies across npm, pip, gem, go, and cargo projects plus Docker, Kubernetes, Terraform, and CloudFormation configurations, querying live CVE data from OSV.dev to identify known vulnerabilities with risk scores.

Can this security analyzer work with Docker and Kubernetes deployments?▼

Yes, the tool scans container images and Kubernetes configurations for CVEs and misconfigurations, applying the same vulnerability detection and risk prioritization used for dependency and infrastructure-as-code analysis.

How do I prioritize which vulnerabilities to fix first?▼

Risk-prioritized remediation generates phased fix plans ranked by severity, providing actual fix commands and TDD validation tests so critical issues are addressed before lower-impact vulnerabilities.

What kind of reports does the security analyzer produce?▼

The tool generates dual reports: detailed technical summaries for engineering teams including CVE data and remediation steps, plus executive summaries for leadership focused on risk posture and business impact.

Does the analyzer support infrastructure-as-code security scanning?▼

Yes, it scans Terraform and CloudFormation configurations for misconfigurations and known vulnerabilities, treating infrastructure code with the same comprehensive vulnerability analysis as application dependencies.

Related Skills

Explore More Software Engineering Skills→
RHEcosystemAppEngRHEcosystemAppEng
48

container-cve-validator

Validates CVEs against Red Hat container images using SBOM attestations and VEX data.

Official
Advanced
meet1919meet1919

swe-bench

Diagnose GitHub issues, generate patches, and validate fixes via shell commands.

Community
Advanced
ChatAndBuildChatAndBuild
1

DevOps IaC Engineer

Automate Terraform, Pulumi, and CloudFormation workflows with policy and drift control.

Official
Advanced
statick88statick88
1

vulnerability-scanning

Automate vulnerability detection across code, dependencies, containers, and infrastructure.

Community
Advanced