skills.rest
meridianhub
meridianhubOFFICIAL
Explore all skills by this author →
WebsiteGitHub

skill-security-practices

Automate security scanning with gosec, Trivy, and SBOM generation in CI/CD pipelines.

10|2|Updated Oct 24, 2025
Search Tags:#compliance#vulnerability-management#sbom#security-scanning#container-security#ci-cd-security
One-click install
npx skills add https://github.com/meridianhub/meridian --skill skill-security-practices
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-security-practices
Source: https://github.com/meridianhub/meridian/tree/main/.claude/skills/security
Command: npx skills add https://github.com/meridianhub/meridian --skill skill-security-practices

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automates security scanning, vulnerability management, and governance across the software lifecycle to reduce risk and ensure compliance.

Core Features & Use Cases

  • Automated security checks: Use gosec for Go code scanning and Trivy for container and dependency scanning.
  • SBOM generation: Produce Software Bill of Materials for supply-chain transparency.
  • CI/CD integration: Enforce security checks in pipelines and generate remediation guidance.
  • Vulnerability prioritization: Align fixes with risk-based prioritization and audit trails.

Quick Start

Run a full security scan of the repository in CI and generate a remediation plan.

Frequently Asked Questions about skill-security-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate security scanning and vulnerability management in a CI/CD pipeline?▼

Automating security scanning in a CI/CD pipeline involves integrating tools like gosec and Trivy to continuously identify vulnerabilities and enforce security policies across the software development lifecycle.

What is SBOM generation and how does it improve supply-chain compliance?▼

SBOM generation produces a Software Bill of Materials that details software components and dependencies, improving supply-chain transparency and ensuring compliance across the development lifecycle.

Can I use Trivy and gosec for container and dependency scanning in production hardening workflows?▼

Yes, Trivy scans containers and dependencies while gosec analyzes Go source code, together automating vulnerability detection and policy enforcement for production hardening workflows.

How do I prioritize vulnerability remediation and generate audit trails for compliance?▼

Vulnerability prioritization aligns security fixes using risk-based assessment, generating remediation guidance and audit trails to reduce risk and ensure strict compliance governance.

Does automated security scanning require integrating external tools to generate remediation plans?▼

Automated security scanning requires integration with tools like gosec, Trivy, and SBOM generators to successfully automate vulnerability detection and output actionable remediation plans.

What is the best way to enforce security checks and policy compliance across the software lifecycle?▼

Enforcing security checks requires integrating automated vulnerability scanning and SBOM generation into CI/CD pipelines, applying policy governance to reduce risk and maintain compliance.

Related Skills

Explore More Software Engineering Skills→
duanbiao2000duanbiao2000
3

gitlab-ci-patterns

Automate GitLab CI/CD pipeline design with multi-stage workflows, caching, and distributed runners.

Community
Advanced
NVIDIANVIDIA
8.1k

sbom

Generate CycloneDX SBOMs with Syft, resolve licenses, and export CSV reports.

Official
Intermediate
HabitaNexusHabitaNexus
1

Container Security

Scan, sign, and monitor container images across Kubernetes clusters.

Official
Advanced
josavicentevwjosavicentevw
1

devsecops

Automate security scanning and governance across CI/CD pipelines and compliance workflows.

Community
Advanced