skills.rest
nexus-substrate
nexus-substrateOFFICIAL
Explore all skills by this author →
GitHub

security-scanning

Triage CodeQL and secret scanning alerts, fix findings, and classify secrets.

18|1|Updated Jan 3, 2026
Search Tags:#github actions#regression testing#security scanning#credential rotation#codeql#vulnerability remediation#secret scanning
One-click install
npx skills add https://github.com/nexus-substrate/nexus-agents --skill security-scanning-nexus-substrate
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scanning
Source: https://github.com/nexus-substrate/nexus-agents/tree/main/skills/security-scanning
Command: npx skills add https://github.com/nexus-substrate/nexus-agents --skill security-scanning-nexus-substrate

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams review security scanning findings from CodeQL and secret scanning, then safely apply fixes or remediation so real vulnerabilities are addressed without introducing new risk.

Core Features & Use Cases

  • Alert triage and prioritization: Classifies CodeQL and secret scanning alerts by severity and determines whether findings are real issues or test fixtures.
  • CodeQL-guided remediation: Applies targeted fixes based on alert category (e.g., shell-injection patterns, insecure randomness, rate-limiting gaps) and verifies changes with tests.
  • Secret scanning response workflow: Distinguishes real secrets from fake test constants, rotates and revokes active credentials, updates references, and resolves alerts without committing secrets.
  • Reporting and audit-friendly tracking: Creates or updates an issue summarizing findings and actions taken, supporting review and accountability.

Quick Start

Ask an AI agent to run security-scanning for your repository and review all newly reported open CodeQL and secret scanning alerts, applying safe fixes and opening a tracking issue.

Frequently Asked Questions about security-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage CodeQL alerts and fix vulnerabilities in GitHub Actions?▼

Triage CodeQL alerts by classifying severity, applying targeted fixes for patterns like shell-injection, and verifying changes with regression tests. This ensures vulnerabilities are addressed without introducing new risk during CI post-processing.

What is the best way to handle secret scanning alerts and rotate exposed credentials?▼

Handle secret scanning alerts by distinguishing real secrets from test fixtures, rotating and revoking active credentials, updating references, and resolving alerts without committing the secrets to your repository.

How do I know if a secret scanning match is a real exposed credential or a test fixture?▼

Determine if a secret match is a test fixture by analyzing the context of the affected files. Real exposed credentials require rotation and revocation, while test constants can be safely classified and dismissed.

Does security-scanning work for manual code reviews or only CI pipelines?▼

Security-scanning applies during CI post-processing, system review phases, and manual security alert checks. It reads affected files, adds regression tests for real vulnerabilities, and updates a tracking issue for accountability.

How do I track security remediation actions for audit purposes?▼

Track security remediation by creating or updating a tracking issue that summarizes CodeQL and secret scanning findings, severity triage, and actions taken, supporting review and accountability.

Why do I need to add regression tests when remediating CodeQL findings?▼

Add regression tests when remediating CodeQL findings to verify that targeted fixes for issues like insecure randomness or rate-limiting gaps are effective and do not introduce new vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
issdandavisissdandavis
6

scbe-code-scanning-ops

Automate triage and remediation of SCBE code-scanning alerts.

Community
Intermediate
hackefellerhackefeller
1

jinn-archive

Close Linear projects and surface follow-up issues before archiving.

Official
Intermediate
vecearvecear

quality-gates-enforcer

Enforce coverage, linting, type checking, and security thresholds in CI pipelines.

Community
Advanced
Mentor-WizardMentor-Wizard
10

security-reviewer

Conduct security audits with SAST scans, vulnerability analysis, and penetration testing.

Official
Advanced