Security Scanning
Adds baseline CI security scanning with secrets detection, dependency checks, and SAST in a way that won't grind your pipeline to a halt on day one. The progressive disclosure starts with high-signal checks and lets you ratchet up coverage over time instead of drowning in noise. Smart bit is the exception handling: every bypass needs an owner, expiry date, and justification, so your technical debt stays visible. Built for teams that want real security gates without turning every PR into a negotiation. Includes a tooling matrix and triage workflows so you're not reinventing the wheel when Dependabot flags your third transitive vulnerability this week.
- skills.sh installs
- 377
- GitHub stars
- 79
- last updated
- Aug 21, 2026
Install
$ npx -y skills add bobmatnyc/claude-mpm-skills --skill security-scanning --agent claude-codeInstalls into .claude/skills of the current project.
Files
Security Scanning
Quick Start
- Secrets: fail fast; rotate on exposure.
- Dependencies: gate critical/high; automate updates.
- SAST: start high-signal; ratchet over time.
- Open Source Safety: score components on three axes — license tier, severity-weighted CVEs, obsolescence.
- Exceptions: require reason, owner, and expiry.
Open Source Safety
Third-party component risk is more than "vulnerable: yes/no". Evaluate each component on three independent dimensions and gate on the worst:
- License risk: HIGH = strong copyleft / GPL/AGPL/LGPL (whole-app disclosure risk);
MEDIUM = weak copyleft / MPL, EPL (modification disclosure only); LOW = permissive /
MIT, Apache-2.0, BSD. Unknown/
NOASSERTION→ treat as HIGH until identified. - CVE weighting: weight by severity (critical ≫ high ≫ medium ≫ low) rather than raw counts; critical/high block, medium/low track with owner + expiry.
- Obsolescence: score the gap to latest version; majors-behind or unmaintained upstream is elevated risk.
See references/open-source-safety.md for the full framework, tier tables, the CVE
weighting model, obsolescence scoring, and the transitive-dependency trust model.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/bobmatnyc/claude-mpm-skills
- Category
- Security
- First seen
- Jun 3, 2026
More from bobmatnyc/claude-mpm-skills
All 158- Test Quality Inspector376
- Svelte5 Runes Static373
- Stacked Prs371
- Better Auth Core368
- Homebrew Formula Maintenance366
- Better Auth Integrations363
- Reporting Pipelines363
- Better Auth Plugins362
- Git Worktrees360
- Nextjs Core357
- Fastapi Local Dev356
- Vb Winforms356
- Headlessui355
- Jest Typescript354
- Vercel Networking Domains353
- Svelte352
- Sec Edgar Pipeline351
- Env Manager350
- Mongodb350
- Vb Core350
- Phoenix Api Channels348
- Digitalocean Containers Images347
- Hono Jsx347
- Langgraph346
Recommended
More Security
alicloud-security-kmscinience/alicloud-skillsManage Alibaba Cloud Key Management Service (KMS) via OpenAPI/SDK. Use whenever the user needs key lifecycle/resource operations, policy/configuration changes, 267skills.sh installs
alicloud-security-center-sascinience/alicloud-skillsManage Alibaba Cloud Security Center (Sas) via OpenAPI/SDK. Use whenever the user needs Security Center resource operations, configuration updates, status queri260skills.sh installs
security-best-practicesdavila7/claude-code-templatesPerform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best pr246skills.sh installs
jwt-authenticationpluginagentmarketplace/custom-plugin-nodejsImplement secure JWT (JSON Web Token) authentication in Node.js applications with access/refresh tokens and role-based access control226skills.sh installs