security-scanning

$npx mdskill add bobmatnyc/claude-mpm-skills/security-scanning

Run CI security scans with triage and expiring exceptions.

  • Detect secrets, vulnerable dependencies, and SAST issues in CI pipelines.
  • Integrates with CI systems and dependency registries for scanning.
  • Evaluates risk via license tiers, CVE severity, and obsolescence scores.
  • Outputs scan results with triage guidance and expiring exception tracking.

SKILL.md

.github/skills/security-scanningView on GitHub ↗
---
name: security-scanning
description: "CI security scanning: secrets, deps, SAST, triage, expiring exceptions"
user-invocable: false
disable-model-invocation: true
license: MIT
compatibility: claude-code
metadata:
  version: 1.2.0
  category: universal
  author: Claude MPM Team
  updated: "2026-06-15"
progressive_disclosure:
  entry_point:
    summary: "Baseline CI scans (secrets, deps, SAST) with triage and expiring exceptions"
tags: [security, scanning]
---

# Security Scanning

## Quick Start

- Secrets: fail fast; rotate on exposure.
- Dependencies: gate critical/high; automate updates.
- SAST: start high-signal; ratchet over time.
- Open Source Safety: score components on three axes — license tier, severity-weighted CVEs, obsolescence.
- Exceptions: require reason, owner, and expiry.

## Open Source Safety

Third-party component risk is more than "vulnerable: yes/no". Evaluate each component on
three independent dimensions and gate on the worst:

- **License risk:** HIGH = strong copyleft / GPL/AGPL/LGPL (whole-app disclosure risk);
  MEDIUM = weak copyleft / MPL, EPL (modification disclosure only); LOW = permissive /
  MIT, Apache-2.0, BSD. Unknown/`NOASSERTION` → treat as HIGH until identified.
- **CVE weighting:** weight by severity (critical ≫ high ≫ medium ≫ low) rather than raw
  counts; critical/high block, medium/low track with owner + expiry.
- **Obsolescence:** score the gap to latest version; majors-behind or unmaintained
  upstream is elevated risk.

See `references/open-source-safety.md` for the full framework, tier tables, the CVE
weighting model, obsolescence scoring, and the transitive-dependency trust model.

## Load Next (References)

- `references/tooling-matrix.md`
- `references/ci-workflows.md`
- `references/triage-and-remediation.md`
- `references/common-findings-and-fixes.md`
- `references/supply-chain-and-sbom.md`
- `references/open-source-safety.md`

More from bobmatnyc/claude-mpm-skills

SkillDescription
anthropicOfficial Anthropic SDK for Claude AI with chat, streaming, function calling, and vision capabilities
api-design-patternsComprehensive API design patterns covering REST, GraphQL, gRPC, versioning, authentication, and modern API best practices
api-documentationBest practices for documenting APIs and code interfaces, eliminating redundant documentation guidance per agent.
api-reviewAPI security checklist for reviewing endpoints before deployment. Use when creating or modifying API routes to ensure proper authentication, authorization, and input validation.
asyncioPython asyncio - Modern concurrent programming with async/await, event loops, tasks, coroutines, primitives, aiohttp, and FastAPI async patterns
axumAxum (Rust) web framework patterns for production APIs: routers/extractors, state, middleware, error handling, tracing, graceful shutdown, and testing
bad-example-skillANTI-PATTERN - Example showing violations of self-containment (DO NOT COPY)
better-auth-authenticationBetter Auth authentication flows for TypeScript apps. Use when enabling email/password auth, configuring social providers, or implementing sign-up, sign-in, and verification flows.
better-auth-coreBetter Auth core setup for TypeScript apps. Use when configuring the Better Auth instance, wiring server handlers and client instances, working with sessions, or calling server-side auth APIs.
better-auth-integrationsBetter Auth framework integrations for TypeScript. Use when wiring route handlers in Next.js, SvelteKit, Remix, Express, Hono, or other web frameworks.