security-metrics

Name: security-metrics
Availability: InStock
Author: 3horizons

Collect and analyze GitHub Advanced Security metrics for code scanning, secret scanning, and Dependabot alerts.

Updated Aug 23, 2026

Search Tags:#security #vulnerability #github #metrics #dependabot #code scanning #secret scanning

Ready to run

npx skills add https://github.com/3horizons/agentic-devops-platform --skill security-metrics

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-metrics
Source: https://github.com/3horizons/agentic-devops-platform/tree/main/.github/skills/security-metrics
Command: npx skills add https://github.com/3horizons/agentic-devops-platform --skill security-metrics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you understand and improve your organization's security posture within GitHub by collecting and analyzing metrics from GitHub Advanced Security features.

Core Features & Use Cases

Security Metrics Collection: Gathers data on code scanning alerts, secret scanning alerts, and Dependabot alerts.
Posture Analysis: Provides insights into alert trends, Mean Time To Remediate (MTTR), and GitHub Advanced Security (GHAS) enablement.
Use Case: A security manager can use this Skill to generate a weekly report on the number of open critical code scanning alerts across all repositories, track the trend of secret scanning bypasses, and identify repositories that are not yet covered by GHAS.

Quick Start

Collect and display open code scanning alerts by severity for the current repository.

Frequently Asked Questions about security-metrics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I collect GitHub Advanced Security metrics for code scanning and Dependabot alerts?▼

To collect GitHub Advanced Security metrics, this Skill gathers data on code scanning, secret scanning, and Dependabot alerts. It requires GitHub CLI authentication with appropriate scopes and GHAS enablement on target repositories to analyze your security posture.

Can I track Mean Time To Remediate (MTTR) and alert trends across my GitHub organization?▼

You can track MTTR and alert trends through posture analysis. This Skill provides insights into Mean Time To Remediate, alert trends, and GitHub Advanced Security enablement across your repositories for proactive vulnerability management.

How do I generate a compliance report for open critical code scanning alerts?▼

Generating a compliance report for open code scanning alerts is supported by this Skill's security metrics collection. It gathers alert data by severity, allowing security managers to report on vulnerabilities and track secret scanning bypasses.

Does auditing GitHub security posture require GitHub CLI authentication?▼

Auditing GitHub security posture with this Skill does require GitHub CLI authentication. You must authenticate with appropriate scopes and ensure GitHub Advanced Security (GHAS) is enabled on the target repositories to successfully collect metrics.

What is the best way to identify repositories not yet covered by GitHub Advanced Security?▼

The best way to identify repositories lacking GHAS coverage is using this Skill's posture analysis. It audits your GitHub organization to pinpoint repositories that are not yet enabled for GitHub Advanced Security features.

Why are my Dependabot alerts not showing up in the security metrics collection?▼

Dependabot alerts may not show up if GHAS is not enabled on target repositories. This Skill requires GitHub Advanced Security enablement and proper GitHub CLI authentication scopes to successfully collect vulnerability and secret scanning metrics.