Run automated SAST and SCA scans on changed code and dependencies.
npx skills add https://github.com/davidmatousek/tachi --skill security-davidmatousek
Please help me install this Agent Skill. Skill: security Source: https://github.com/davidmatousek/tachi/tree/main/.claude/skills/security Command: npx skills add https://github.com/davidmatousek/tachi --skill security-davidmatousek
Claude-powered SAST and SCA security scan skill. Invoked automatically as the Security Scan step (Step 7) of /aod.build (after Design Quality Gate, before Code Simplification) or standalone via /security. Analyzes all code files and dependency manifests changed on the feature branch relative to main for OWASP Top 10 vulnerability patterns and known CVE findings. Produces a human-readable security-scan.md report and machine-readable .security/ compliance artifacts (scan-log.jsonl, vulnerabilities.jsonl, SARIF 2.1.0, CycloneDX 1.5 SBOM). Blocks build progression on CRITICAL/HIGH findings with an explicit acknowledgment gate. Use --no-security in /aod.build to skip. Invoke /security directly for standalone analysis outside the build pipeline.
Run /security in any project directory to perform an automated security scan and generate audit artifacts.
High-intent search queries and answers about installing and using this skill.
Automate SAST and SCA security scans by running /security in any project directory to detect OWASP Top 10 patterns and known CVEs in changed code and dependency manifests. The scan generates human-readable reports and machine-readable compliance artifacts like SARIF and CycloneDX SBOM.
Block CI-CD pipeline builds on critical vulnerabilities by enforcing a governance gate that stops progression on CRITICAL or HIGH findings. The security scan requires explicit acknowledgment before allowing the build to continue, ensuring unmitigated high-severity risks are reviewed.
SAST vulnerability scanning for feature branches works by analyzing all changed code files relative to the main branch. It identifies OWASP Top 10 vulnerability patterns in the modified code and outputs both human-readable security reports and machine-readable JSON logs for governance.
You can generate SARIF 2.1.0 and CycloneDX 1.5 SBOM artifacts for compliance auditing by running an automated SCA scan on dependency manifests. The scan produces these machine-readable compliance artifacts alongside a human-readable security-scan.md report.
The security scan does not require any specific dependencies or external components to run. It operates standalone within any project directory using the /security command, or automatically as a built-in step within the /aod.build pipeline.
Your security scan is blocking build pipeline progression because it detected CRITICAL or HIGH severity vulnerabilities in your changed code or dependencies. The governance gate enforces this block and requires explicit acknowledgment of the findings before the build can proceed.
endorlabsAutomate pre-PR security reviews by scanning changed files for vulnerabilities, secrets, licenses, and compliance issues.
idchain-worldParse SARIF 2.1.0 analysis results and deduplicate findings by fingerprint.
vladm3105Automate code review across multi-language repositories with static analysis and security scanning.
ResgridScan .NET applications for security weaknesses with severity-rated findings.
