security-pipeline

Name: security-pipeline
Availability: InStock
Author: xtrm-dev

Bootstrap a GitHub security pipeline with secret scanning, SAST, and dependency checks.

4|1|Updated Nov 1, 2025

Search Tags:#security #github #pre-commit #semgrep #gitleaks #dependabot #vulnerability-scanning

Ready to run

npx skills add https://github.com/xtrm-dev/specialists --skill security-pipeline-xtrm-dev

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-pipeline
Source: https://github.com/xtrm-dev/specialists/tree/main/.xtrm/skills/default/security-pipeline
Command: npx skills add https://github.com/xtrm-dev/specialists --skill security-pipeline-xtrm-dev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gh, git, python3, pre-commit, semgrep, gitleaks, osv-scanner, and includes scripts (resource) components.

What problem does it solve?

This Skill sets up a practical security baseline for repositories that need protection against secrets, vulnerabilities, and unsafe code changes without relying on GitHub Advanced Security.

Core Features & Use Cases

Repository hardening: Adds Dependabot, OSV scanning, Semgrep, Gitleaks, and local pre-commit and pre-push gates.
GitHub workflow automation: Generates CI workflows and repo config tailored to the detected ecosystem.
Safe adoption: Handles existing hooks carefully and preserves pre-existing local changes while installing the security pipeline.
Use Case: A small team can apply this skill to a new private repo and quickly get continuous dependency checks, secret scanning, SAST, and review-ready guardrails.

Quick Start

Use the security-pipeline skill to bootstrap Dependabot, OSV, Semgrep, Gitleaks, pre-commit hooks, and Codex review on the target GitHub repository.

Frequently Asked Questions about security-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I set up a GitHub security pipeline without Advanced Security?▼

Set up a GitHub security pipeline by bootstrapping Dependabot, Semgrep, Gitleaks, and OSV scanning. This generates CI workflows and local pre-commit hooks to provide SAST, secret scanning, and vulnerability checks without needing GitHub Advanced Security.

Can I add pre-commit hooks and Semgrep to an existing repository safely?▼

Yes, you can add pre-commit hooks and Semgrep to an existing repository safely. The installation process carefully handles existing hooks and preserves any pre-existing local changes while applying the new security gates.

How do I configure Dependabot and vulnerability scanning for a new repository?▼

Configure Dependabot and vulnerability scanning by detecting the repository ecosystem and generating tailored CI workflows. This automatically creates the necessary configuration files to enable continuous dependency checks and OSV scanning.

What tools do I need to automate SAST and secret scanning on GitHub?▼

To automate SAST and secret scanning on GitHub, you need pre-commit, Semgrep, Gitleaks, and osv-scanner. These tools run diff-aware pre-push scanning and CI workflows to block secrets and unsafe code changes.

Does this security pipeline work with any programming language ecosystem?▼

The security pipeline adapts to your specific programming language ecosystem through automatic ecosystem detection. It then generates tailored Dependabot configurations and CI workflows based on the detected environment.

How do I enforce local security checks before pushing code to GitHub?▼

Enforce local security checks before pushing code by installing pre-commit and pre-push gates. These hooks run diff-aware scanning using Semgrep and Gitleaks to block secrets and unsafe changes locally before they reach CI.