security-scanning

Automate CI security scanning for secrets, dependencies, and SAST findings with triage and expiring exceptions.

3|1|Updated Dec 8, 2025

Search Tags:#security #dependencies #secrets #triage #scanning #SAST #CI

Ready to run

npx skills add https://github.com/bobmatnyc/terminator --skill security-scanning

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scanning
Source: https://github.com/bobmatnyc/terminator/tree/main/.claude/skills/universal-security-security-scanning
Command: npx skills add https://github.com/bobmatnyc/terminator --skill security-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

## What problem does it solve? This Skill automates CI security scanning to detect secrets, vulnerable dependencies, and SAST issues, while providing triage workflows and expiring exception management.

## Core Features & Use Cases

Secrets: fail-fast secret detection and rotation guidance.
Dependencies: gate critical/high vulnerabilities and automate remediation.
SAST: start with high-signal rules and expand as confidence grows.
Exceptions: require reason, owner, and expiry to govern risk acceptance.

### Quick Start Run baseline security scans on your repository: enable secrets, dependency, and SAST checks; configure triage and expiry rules; start with a minimal policy.

Frequently Asked Questions about security-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate CI security scanning for secrets and vulnerable dependencies?▼

Automate CI security scanning by enabling fail-fast secret detection and dependency gating for critical vulnerabilities. Configure triage rules to manage findings and enforce governance using documented exceptions with required reasons, owners, and expiry dates.

What is the best way to triage SAST findings in GitHub pull requests?▼

Triage SAST findings in pull requests by starting with high-signal rules and expanding gradually. Apply automated triage workflows to guide immediate remediation and manage accepted risks using expiring exceptions with documented owners.

How do I manage security scan exceptions without losing track of accepted risks?▼

Manage security scan exceptions by requiring a documented reason, owner, and expiry date for each accepted risk. This governs risk acceptance and ensures vulnerabilities are automatically revisited when exceptions expire.

Does CI security scanning work for scheduled runs across multiple software projects?▼

Yes, CI security scanning applies to both PR checks and scheduled runs across software projects. It guides immediate remediation for secrets, dependencies, and SAST findings while supporting longer-term risk reduction strategies.

Why should I start with high-signal SAST rules instead of enabling all checks?▼

Start with high-signal SAST rules to minimize false positives and focus remediation efforts. Expand the rule set as confidence grows, enabling effective triage and remediation without overwhelming developers with alert fatigue.