security-auditor

Automate pre-deployment security audits by running parallel scans with Trivy and Semgrep across monorepo packages. The audit detects project context, resolves scope per package, and compiles findings into a unified markdown report at .opencode/docs/SECURITY-AUDIT.md to gate releases.

Yes, you can run Semgrep for SAST and Trivy for secrets, dependencies, and misconfigurations in parallel during CI pipelines. The skill aggregates these scans alongside GitHub security alerts to block risky deployments based on configurable severity gates.

Block risky releases by configuring severity gates within your deployment pipeline. The security audit aggregates findings from Trivy, Semgrep, and GitHub alerts, then outputs a markdown report to gate deployment decisions before production release.

Yes, you need gh and jq installed to fetch and parse GitHub security alerts. These dependencies are required alongside Trivy and Semgrep to execute the full audit script and aggregate security findings into the deployment gate.

Scope resolution for multi-package audits works by detecting the monorepo structure and deployment context, then tailoring vulnerability scans per package. This ensures security findings are accurately mapped to specific deployment scopes before aggregation.

Trivy handles secrets, dependencies, and misconfigurations but does not perform SAST code analysis. The audit script pairs Trivy with Semgrep to cover static code analysis, ensuring comprehensive vulnerability detection before compiling the unified report.