Menu
Run the security scanner. Activate on ship / deploy / launch / "is this safe?" — before the deploy happens.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Guard risky writes. Activate before eval/exec, string-concat SQL, md5/sha1/DES/RC4 crypto, or auth/jwt/oauth/cipher.
Explain or teach a vuln. Activate on a CVE/GHSA id, "what is this vuln", "explain finding", or a Socratic walkthrough.
Rotate a leaked secret end-to-end. Activate on leaked API key, exposed credential, or pushed-secret reports.
Privacy review before handling user data. Activate on PII/PHI/PCI shapes (email, SSN, CC, MRN). Writes DATA_FLOW.md.
Apply a remediation patch via the deterministic MCP toolchain. Activate when user asks to fix a scanner finding.
Walk through the six-step recipe for adding a new SAST detector — pick the module, export scan*(), wire, fixture, test.
| name | agentic-security:security-scan-on-deploy |
| description | Run the security scanner. Activate on ship / deploy / launch / "is this safe?" — before the deploy happens. |
Activates when the user is about to push code to production, asks if their
project is safe to ship, or mentions any of the destructive-prone deploy
commands (vercel --prod, fly deploy, wrangler publish, npm publish,
gh pr merge --auto).
Check for fresh scan state. Read
.agentic-security/last-scan.json mtime. If it's older than
24 hours OR doesn't exist, run a fresh scan first:
/scan --all for the full surface, or /scan --uncommitted if
the user only edited a few files.
Render the verdict, not the wall of findings. The user is making a deploy decision, not auditing. Lead with:
/compliance --attestation to
generate the badge./fix --all --critical for batch remediation, or recommend wiring the
CI bench gate so blocking is automatic next time./triage --show --all before deploy, mention the deploy is
still possible but flag the risk.Surface the production-aware filters. If /scan --exposed-only
has been configured (WAF / auth-middleware / network-policy
ingest), use it. A finding the WAF already blocks shouldn't
block the deploy.
Offer one-finding triage flow. If there's one blocker,
suggest:
/triage --explain <id> → /fix --one <id> → re-scan → ship.
Don't just list the finding and walk away.
.agentic-security/last-scan.json mtime first; reuse if fresh./scan --all — full sweep/scan --uncommitted — only the user's recent edits/secure — vibecoder router; figures out the right next action/compliance --attestation — generate the badge / deploy-ready attestation/find-and-fix-everything — batch remediation pass before deploy