security-testing

Automate security testing with Snyk, Semgrep, Gitleaks, and OWASP ZAP in CI/CD pipelines.

14|3|Updated Feb 22, 2026

Search Tags:#testing #ci/cd #security #vulnerability scanning #semgrep #snyk #owasp zap

Ready to run

npx skills add https://github.com/rnavarych/alpha-engineer --skill security-testing-rnavarych

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-testing
Source: https://github.com/rnavarych/alpha-engineer/tree/main/plugins/billy-milligan/skills/quality/security-testing
Command: npx skills add https://github.com/rnavarych/alpha-engineer --skill security-testing-rnavarych

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you proactively identify and mitigate security vulnerabilities in your codebase and CI/CD pipelines, preventing breaches and ensuring compliance.

Core Features & Use Cases

Dependency Scanning: Detects known vulnerabilities in project dependencies (e.g., npm, Snyk).
SAST & Secrets Scanning: Analyzes code for common security flaws and prevents secrets from being committed.
DAST Integration: Facilitates dynamic application security testing against running applications.
Use Case: Integrate this Skill into your GitHub Actions to automatically scan for critical vulnerabilities in dependencies and code on every pull request, failing the build if high-severity issues are found.

Quick Start

Use the security-testing skill to set up Snyk dependency scanning in your GitHub Actions workflow.

Frequently Asked Questions about security-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I integrate SAST and dependency scanning into my CI/CD pipelines?▼

Automate security testing in CI/CD pipelines by integrating tools like Snyk for dependency vulnerabilities and Semgrep for static code flaws, enforcing security best practices through automated scanning and reporting on every pull request.

How does automated secrets scanning prevent exposed credentials in my codebase?▼

Automated secrets scanning prevents exposed credentials by integrating Gitleaks into CI/CD pipelines to detect sensitive data, mitigating risks of exposed secrets and ensuring they are not committed to the repository.

Can I use OWASP ZAP for dynamic application security testing in GitHub Actions?▼

Yes, you can use OWASP ZAP for dynamic application security testing in GitHub Actions, facilitating DAST integration to identify dynamic application weaknesses against your running applications automatically.

What is the best way to automate vulnerability scanning for project dependencies?▼

The best way to automate vulnerability scanning for project dependencies is integrating Snyk into CI/CD pipelines, detecting known vulnerabilities in dependencies like npm packages to proactively prevent breaches and ensure compliance.

Do I need specific security tools to scan for static code flaws and exposed secrets?▼

You need security tools like Semgrep and Gitleaks to scan for static code flaws and exposed secrets, addressing risks related to common security flaws and preventing secrets from being committed to your codebase.