A small, opinionated pack of agent skills for running security scans — secret scanning, dependency CVE auditing, SAST, and a composed pre-release gate. Each skill is a plain-Markdown SKILL.md with frontmatter: drop it into any agent that reads skills (Vanta, Claude Code, Codex, anything skill-aware), or read it yourself as a runbook.
These aren't generated prose. Each skill is grounded in a scan that was actually run against a real Rust + TypeScript codebase, and each carries the part that tooling tutorials skip: how to triage the output (reachability before severity, source→sink before fixing) and the boundary (what the scan does not establish).
git clone https://github.com/jpoindexter/security-skills
./security-skills/scan.sh /path/to/your/repo # defaults to the current dirscan.sh is the security-preflight gate as an executable: it runs the whole pack — secrets → dependency CVEs → SAST — with whatever scanners you have installed, and prints a verdict. Only a leaked secret hard-fails (it's irreversible once a repo is public); dependency and SAST findings are reported for you to triage per the runbooks. Install the scanners once:
brew install gitleaks osv-scanner cargo-audit semgrep # macOS; each tool documents other platforms| Skill | Scans | What it adds beyond "run the tool" |
|---|---|---|
| secret-scan | gitleaks (full history + staged) |
Rotate-first-then-scrub order; history is forever; allowlist vs disable |
| dependency-audit | npm audit, cargo audit, osv-scanner, pip-audit |
Triage by reachability (runtime vs dev) before severity; least-disruptive remediation |
| sast-scan | semgrep, codeql |
Trace source → sink before fixing; per-line suppress with a why, never blanket-ignore |
| security-preflight | composes the three | One pass/triage gate before going public or tagging a release — the security sibling of ship-preflight |
Vanta auto-installs any skill library on the repo root list — clone next to your repos and it picks them up, or copy in:
git clone https://github.com/jpoindexter/security-skills
cp -r security-skills/*/ ~/.vanta/skills/ # global installClaude Code / Codex / other — copy the skill dirs into your skills directory (e.g. ~/.claude/skills/); they're standard SKILL.md files.
As runbooks — just read them. Every command is copy-pasteable.
- Grounded, not generated — every command was run against a real codebase before it went in the skill.
- Triage is the skill — running the scanner is one line; knowing which of 11 findings actually matters is the value.
- Honest boundaries — each skill states what its scan does NOT catch. A green scan is necessary, never sufficient.
- Rotate first — for secrets, the order is non-negotiable: revoke at the provider, then scrub history.
MIT. Contributions welcome — add a <slug>/SKILL.md for another scan (container/IaC via trivy, license compliance, IaC misconfig) and open a PR.