skill-security-practices

Name: skill-security-practices
Availability: InStock
Author: meridianhub

Automate security scanning with gosec, Trivy, and SBOM generation in CI/CD pipelines.

10|2|Updated Oct 24, 2025

Search Tags:#compliance #vulnerability-management #sbom #security-scanning #container-security #ci-cd-security

Ready to run

npx skills add https://github.com/meridianhub/meridian --skill skill-security-practices

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skill-security-practices
Source: https://github.com/meridianhub/meridian/tree/main/.claude/skills/security
Command: npx skills add https://github.com/meridianhub/meridian --skill skill-security-practices

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automates security scanning, vulnerability management, and governance across the software lifecycle to reduce risk and ensure compliance.

Core Features & Use Cases

Automated security checks: Use gosec for Go code scanning and Trivy for container and dependency scanning.
SBOM generation: Produce Software Bill of Materials for supply-chain transparency.
CI/CD integration: Enforce security checks in pipelines and generate remediation guidance.
Vulnerability prioritization: Align fixes with risk-based prioritization and audit trails.

Quick Start

Run a full security scan of the repository in CI and generate a remediation plan.

Frequently Asked Questions about skill-security-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate security scanning and vulnerability management in a CI/CD pipeline?▼

Automating security scanning in a CI/CD pipeline involves integrating tools like gosec and Trivy to continuously identify vulnerabilities and enforce security policies across the software development lifecycle.

What is SBOM generation and how does it improve supply-chain compliance?▼

SBOM generation produces a Software Bill of Materials that details software components and dependencies, improving supply-chain transparency and ensuring compliance across the development lifecycle.

Can I use Trivy and gosec for container and dependency scanning in production hardening workflows?▼

Yes, Trivy scans containers and dependencies while gosec analyzes Go source code, together automating vulnerability detection and policy enforcement for production hardening workflows.

How do I prioritize vulnerability remediation and generate audit trails for compliance?▼

Vulnerability prioritization aligns security fixes using risk-based assessment, generating remediation guidance and audit trails to reduce risk and ensure strict compliance governance.

Does automated security scanning require integrating external tools to generate remediation plans?▼

Automated security scanning requires integration with tools like gosec, Trivy, and SBOM generators to successfully automate vulnerability detection and output actionable remediation plans.

What is the best way to enforce security checks and policy compliance across the software lifecycle?▼

Enforcing security checks requires integrating automated vulnerability scanning and SBOM generation into CI/CD pipelines, applying policy governance to reduce risk and maintain compliance.