skills.rest
arcasilesgroup
arcasilesgroupOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security

Run unified security scans with SAST, DAST, dependency auditing, and SBOM generation.

54|3|Updated Feb 4, 2026
Search Tags:#security#sast#vulnerability management#sbom#dast#dependency scanning
One-click install
npx skills add https://github.com/arcasilesgroup/ai-engineering --skill security-arcasilesgroup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/arcasilesgroup/ai-engineering/tree/main/.agents/skills/security
Command: npx skills add https://github.com/arcasilesgroup/ai-engineering --skill security-arcasilesgroup

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gitleaks, semgrep, trivy, nuclei, zap-cli, pip-audit, npm, dotnet, cargo, cdxgen, cyclonedx-py, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need for comprehensive security vulnerability detection across static code, running applications, and project dependencies, ensuring a robust security posture.

Core Features & Use Cases

  • Multi-faceted Scanning: Integrates SAST, DAST, dependency auditing, and SBOM generation.
  • Actionable Insights: Provides severity-classified findings with OWASP mapping and remediation guidance.
  • Use Case: Before deploying a new microservice, run the security skill in static and deps modes to identify and fix critical vulnerabilities and outdated dependencies, preventing potential breaches.

Quick Start

Run a full security scan including static analysis, dependency checks, and SBOM generation for the current project.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run unified security scanning including SAST and dependency checks?▼

Unified security scanning is performed by running the skill in static and dependency modes, executing static analysis and dependency audits to identify vulnerabilities and outdated dependencies before deployment.

What is SBOM generation and when do I need it for vulnerability management?▼

SBOM generation creates a software bill of materials listing project components. It is needed during vulnerability management to detect outdated dependencies and map identified risks to remediation steps.

Can I use semgrep and trivy for static analysis and dependency scanning in the same project?▼

Yes, semgrep and trivy are integrated to perform static analysis and dependency scanning together, generating SBOMs and mapping vulnerabilities to OWASP Top 10 categories for comprehensive remediation.

Do I need to install gitleaks and cdxgen before scanning my codebase?▼

Yes, tools like gitleaks, semgrep, trivy, cdxgen, and nuclei must be installed and configured in your environment before initiating static analysis, dynamic analysis, or SBOM generation workflows.

Does dynamic application security testing support containerized environments?▼

Dynamic application security testing supports containerized environments by utilizing nuclei and zap-cli to scan running applications and map discovered vulnerabilities to OWASP Top 10 remediation steps.

Related Skills

Explore More Software Engineering Skills→
arcasilesgrouparcasilesgroup
54

ai-security

Run unified security scans for SAST, DAST, dependencies, and SBOM generation.

Official
Advanced
dhruvinrsonidhruvinrsoni

secure-coding-review

Review source code for OWASP Top 10 vulnerabilities and hardcoded secrets.

Community
Advanced
HelloEverybobyHelloEveryboby
17

SDLCOrchestrator

Automate SAST, DAST, and SCA security scans in CI/CD pipelines.

Community
Intermediate
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced