blackduck-security-extension

Use when asked to explain how any part of the Black Duck Security Scan ADO extension works — entry flow, product scan setup, Bridge CLI integration, input handling, PR comments, Fix PRs, SARIF upload, airgap mode, proxy/SSL, or version compatibility. Produces a precise, file-linked explanation grounded in the actual source.

Use when implementing any new task in the Black Duck Security Scan ADO extension — adding a product, adding/deprecating a parameter, adding Classic UI support, writing unit tests, upgrading dependencies, upgrading Node.js version, or any other extension feature work. Produces complete, file-accurate implementation steps grounded in existing patterns.

Use when reviewing changes to the Black Duck Security Scan ADO extension. Checks coding standards, established patterns, and backward compatibility — covering input handling, version-gated behavior, Classic Editor parity, error construction, HTTP client usage, task.json integrity, and test coverage. Flags deviations with file:line citations and prescribes the correct pattern.

Use when doing a security review of the Black Duck Security Scan ADO extension. Covers SAST-level checks specific to this codebase — secret/credential logging, command injection, path traversal, TLS bypass, insecure HTTP clients, token leakage in files, proxy credential exposure, input injection into JSON payloads, and ADO pipeline variable security. Produces findings with file:line citations and remediation steps.

Use when asked to analyze what changes are needed to implement a new feature in the Black Duck Security Scan ADO extension. Reads the codebase, maps every file that must change, identifies breakage risks, and writes a structured changes.md file with a prioritized change plan and risk table. Trigger on "analyze this feature", "what needs to change for X", "plan this implementation", "impact analysis for X".