Automate security analysis of code changes with Trail of Bits tools.
npx skills add https://github.com/FC-FUZ/claude-code-governance --skill security-fc-fuz
Please help me install this Agent Skill. Skill: security Source: https://github.com/FC-FUZ/claude-code-governance/tree/main/skills/security Command: npx skills add https://github.com/FC-FUZ/claude-code-governance --skill security-fc-fuz
Unified security analysis powered by Trail of Bits and integrated workflows. One trigger provides full coverage for code changes.
Manual invocation examples show how to trigger the workflow and run the sub-skills.
Run the security skill on this code change to trigger automated Trail of Bits analysis and generate a security report.
High-intent search queries and answers about installing and using this skill.
Automated security analysis for code changes uses Trail of Bits tools to perform differential code review, classify risks from Critical to Low, and generate a unified security report. It coordinates static analysis and supply-chain audits through a single workflow trigger.
Supply-chain risk assessment evaluates dependency exploitation and takeover risks by integrating a dedicated supply-chain-risk-auditor into the centralized security workflow. It scans updated dependencies during code changes to identify and prioritize potential vulnerabilities.
Yes, static analysis integrates CodeQL, Semgrep, and SARIF formats to scan code changes. This combination runs as part of a unified security workflow alongside architectural analysis and differential review to provide comprehensive vulnerability coverage.
Differential review performs security-focused code analysis on changes, classifying identified risks into Critical, High, Medium, and Low categories. It operates as a coordinated sub-skill within the broader Trail of Bits security workflow to prioritize findings.
No, a single trigger initiates the entire unified security workflow, coordinating differential-review, audit-context-building, static-analysis, and supply-chain-risk-auditor automatically. Rule 7 automation and governance checks manage the sub-skills centrally.
Deep architectural analysis applies first-principles methodology for audit-context-building when evaluating complex code changes, while standard static analysis targets specific vulnerability patterns. Both run automatically through the centralized security workflow during code reviews.
AgentSecOpsScan container images, dependencies, and IaC files for vulnerabilities and misconfigurations.
SuperlendParse SARIF 2.1.0 files and extract structured findings for reporting.
BagelHolePerforms static security testing on source code using Semgrep, CodeQL, and SonarQube.
daishimanGenerate standardized security diagnostic reports from vulnerability findings.
