skills.rest
rnavarych
rnavarychCOMMUNITY
Explore all skills by this author →
GitHub

security-testing

Automate security testing with Snyk, Semgrep, Gitleaks, and OWASP ZAP in CI/CD pipelines.

14|3|Updated Feb 22, 2026
Search Tags:#testing#ci/cd#security#vulnerability scanning#semgrep#snyk#owasp zap
One-click install
npx skills add https://github.com/rnavarych/alpha-engineer --skill security-testing-rnavarych
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-testing
Source: https://github.com/rnavarych/alpha-engineer/tree/main/plugins/billy-milligan/skills/quality/security-testing
Command: npx skills add https://github.com/rnavarych/alpha-engineer --skill security-testing-rnavarych

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you proactively identify and mitigate security vulnerabilities in your codebase and CI/CD pipelines, preventing breaches and ensuring compliance.

Core Features & Use Cases

  • Dependency Scanning: Detects known vulnerabilities in project dependencies (e.g., npm, Snyk).
  • SAST & Secrets Scanning: Analyzes code for common security flaws and prevents secrets from being committed.
  • DAST Integration: Facilitates dynamic application security testing against running applications.
  • Use Case: Integrate this Skill into your GitHub Actions to automatically scan for critical vulnerabilities in dependencies and code on every pull request, failing the build if high-severity issues are found.

Quick Start

Use the security-testing skill to set up Snyk dependency scanning in your GitHub Actions workflow.

Frequently Asked Questions about security-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I integrate SAST and dependency scanning into my CI/CD pipelines?▼

Automate security testing in CI/CD pipelines by integrating tools like Snyk for dependency vulnerabilities and Semgrep for static code flaws, enforcing security best practices through automated scanning and reporting on every pull request.

How does automated secrets scanning prevent exposed credentials in my codebase?▼

Automated secrets scanning prevents exposed credentials by integrating Gitleaks into CI/CD pipelines to detect sensitive data, mitigating risks of exposed secrets and ensuring they are not committed to the repository.

Can I use OWASP ZAP for dynamic application security testing in GitHub Actions?▼

Yes, you can use OWASP ZAP for dynamic application security testing in GitHub Actions, facilitating DAST integration to identify dynamic application weaknesses against your running applications automatically.

What is the best way to automate vulnerability scanning for project dependencies?▼

The best way to automate vulnerability scanning for project dependencies is integrating Snyk into CI/CD pipelines, detecting known vulnerabilities in dependencies like npm packages to proactively prevent breaches and ensure compliance.

Do I need specific security tools to scan for static code flaws and exposed secrets?▼

You need security tools like Semgrep and Gitleaks to scan for static code flaws and exposed secrets, addressing risks related to common security flaws and preventing secrets from being committed to your codebase.

Related Skills

Explore More Software Engineering Skills→
htafollahtafolla
5

security-scan

Scan codebases for security vulnerabilities and generate assessment reports.

Community
Intermediate
williamzujkowskiwilliamzujkowski
17

nosql

Mitigate security vulnerabilities from insecure NoSQL patterns in database environments.

Community
Intermediate
ils15ils15
10

quality-gate

Run linters, type-checkers, tests, and build steps before code commits.

Community
Advanced
AcczdyAcczdy
2

implementing-devsecops-security-scanning

Automate SAST, DAST, and SCA security scanning across CI/CD pipelines.

Community
Advanced