bobmatnyc/security-scanning
universal/security/security-scanning/SKILL.md
CI security scanning: secrets, deps, SAST, triage, expiring exceptions
$ install --global
skillsauthnpx skillsauth add bobmatnyc/claude-mpm-skills security-scanningInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 1, 2026, 3:15 AM88.9s8 files scanned
SKILL.md
- name:
- security-scanning
- description:
- CI security scanning: secrets, deps, SAST, triage, expiring exceptions
- user-invocable:
- false
- disable-model-invocation:
- true
- license:
- MIT
- compatibility:
- claude-code
- version:
- 1.2.0
- category:
- universal
- author:
- Claude MPM Team
- updated:
- 2026-06-15
- summary:
- Baseline CI scans (secrets, deps, SAST) with triage and expiring exceptions
- tags:
- [security, scanning]
Security Scanning
Quick Start
- Secrets: fail fast; rotate on exposure.
- Dependencies: gate critical/high; automate updates.
- SAST: start high-signal; ratchet over time.
- Open Source Safety: score components on three axes — license tier, severity-weighted CVEs, obsolescence.
- Exceptions: require reason, owner, and expiry.
Open Source Safety
Third-party component risk is more than "vulnerable: yes/no". Evaluate each component on three independent dimensions and gate on the worst:
- License risk: HIGH = strong copyleft / GPL/AGPL/LGPL (whole-app disclosure risk);
MEDIUM = weak copyleft / MPL, EPL (modification disclosure only); LOW = permissive /
MIT, Apache-2.0, BSD. Unknown/
NOASSERTION→ treat as HIGH until identified. - CVE weighting: weight by severity (critical ≫ high ≫ medium ≫ low) rather than raw counts; critical/high block, medium/low track with owner + expiry.
- Obsolescence: score the gap to latest version; majors-behind or unmaintained upstream is elevated risk.
See references/open-source-safety.md for the full framework, tier tables, the CVE
weighting model, obsolescence scoring, and the transitive-dependency trust model.
Load Next (References)
references/tooling-matrix.mdreferences/ci-workflows.mdreferences/triage-and-remediation.mdreferences/common-findings-and-fixes.mdreferences/supply-chain-and-sbom.mdreferences/open-source-safety.md
Related Skills
bobmatnyc/xquik
tools
VerifiedTrustedCommunity
Xquik X data automation API - Use REST or MCP for tweet search, user lookup, follower exports, media downloads, monitors, webhooks, giveaway draws, and confirmation-gated X actions.
59SKILL.mdUpdated Jul 19, 2026
bobmatnyc/linkedin
tools
VerifiedTrustedCommunity
LinkedIn automation via the Linked API CLI - fetch profiles, search people and companies, send messages, manage connections, create posts, react, comment, and run Sales Navigator and custom workflows. Use when the user wants to interact with LinkedIn.
59SKILL.mdUpdated Jul 19, 2026
bobmatnyc/model-context-builder
tools
VerifiedTrustedCommunity
MCP (Model Context Protocol) server build and evaluation guide, including local conventions for tool surfaces, config, and testing
58SKILL.mdUpdated Jul 9, 2026
bobmatnyc/model-context
tools
VerifiedTrustedCommunity
MCP (Model Context Protocol) - Build AI-native servers with tools, resources, and prompts. TypeScript/Python SDKs for Claude Desktop integration.
58SKILL.mdUpdated Jul 9, 2026