skills

Generic reference for the Fortify CLI (fcli). Install, upgrade, authenticate, fcli environment variables, output formats, SpEL query syntax, variable chaining and custom action framework.

Create new Fortify application(s) in Fortify on Demand (FoD) or Application Security Center (SSC).

Perform tasks against Fortify on Demand (FoD): query applications/releases; query & triage existing security issues in FoD; start & monitor full SAST/DAST/SCA/open source scans of the codebase; create releases; import FPR/SARIF/CycloneDX artifacts; policy and portfolio analysis. NOT for lightweight AI review of local code changes/diffs (use fortify-change-review).

Remediate SAST (static) and DAST (dynamic) security vulnerabilities ALREADY detected by Fortify in FoD or SSC — fix specific issues, categories, or reduce issue counts, including applying SAST Aviator fixes. For SCA / open source dependency findings (vulnerable third-party components, CVEs), use fortify-dependency-upgrade instead. NOT for discovering or reviewing new issues (use fortify-change-review for a local code-change review, or fortify-fod / fortify-ssc to scan and triage).

Perform tasks against Fortify SSC (Software Security Center): query applications/application versions; query & triage existing security issues in SSC; start & monitor full ScanCentral SAST/DAST scans or upload FPR artifacts; create app versions; policy and portfolio analysis. NOT for lightweight AI review of local code changes/diffs (use fortify-change-review).

Lightweight, AI-powered security review of code CHANGES (a diff, PR, or in-session edits) using the agent's own analysis — no Fortify scan engine or platform needed. Use when the user asks to "run a Fortify security review" / "Fortify change review", or when adding/modifying code touching authentication, authorization, input handling, output encoding, data access, file operations, outbound HTTP, deserialization, cryptography, transport security, XML parsing, logging, LLM/agent logic, or IaC (AWS, Azure, GCP, Terraform, Kubernetes, Helm). NOT for full SAST/DAST/SCA scans or triaging issues already found by FoD/SSC (use fortify-fod / fortify-ssc).

Perform dependency upgrade impact assessment, code fixes, and migration work. Use to remediate Fortify SCA / open source / software composition analysis findings — vulnerable third-party dependencies, CVEs/GHSAs, components flagged by FoD or SSC — by upgrading to a safe version and fixing any resulting breakage. Also use when the user asks what will break after a version change, hits compile/test failures, needs code fixed for compatibility, needs help resolving dependency conflicts, or fixing breaking changes from direct or transitive dependency updates, including framework version changes that affect starters, plugins, annotations, configs, or imports. (For SAST/DAST code findings, use fortify-remediate instead.) Covers npm/yarn, Maven/Gradle, pip/poetry, Go modules, Cargo, Bundler, Composer, NuGet, C++ (CMake/Conan/vcpkg), iOS/macOS (CocoaPods/SPM/Carthage), and Scala (sbt/Mill).

Integrate Fortify application security (SAST, SCA, DAST) with GitHub Actions, GitLab Pipelines, Azure DevOps, Jenkins & other CICD/DevSecOps pipelines.

Triage whether a known CVE/GHSA vulnerability is actually exploitable in this project. Use when the user wants a reachability verdict on a specific advisory — is the project really affected, or is the advisory noise? Analysis only; for fixes, hand off to fortify-remediate.