| name | security-analysis |
| description | Dependabot and security analysis skill for HASTE. Parse alerts, group related vulnerabilities, apply severity rules, and produce structured reports. Use when: 'Dependabot alert', 'security scan', 'vulnerability triage', 'dependency audit', 'npm audit', 'pip audit', 'CVE analysis'. |
| source | HASTE security practices, OWASP, NVD |
| domain | security |
| level | intermediate |
| agents | ["security","security-validation"] |
| created_date | 2026-04-27 |
| last_validated | |
| validated_by | |
| status | draft |
Security Analysis
Overview
Structured process for triaging Dependabot alerts, grouping related vulnerabilities, applying severity rules, and producing actionable reports for HASTE's Python and JavaScript dependency stacks.
Key Concepts
HASTE Dependency Landscape
| Stack | Location | Tool | Key Risks |
|---|
| Python (API) | api/hastefuncapi/requirements.txt | pip audit | GDAL parsing, Azure SDK, rasterio |
| Python (Queues) | api/hastefuncqueues/requirements.txt | pip audit | Same as API |
| Python (Core) | hastelib/pyproject.toml | pip audit | Geospatial libs, ML deps |
| JavaScript (UI) | ui/package.json | npm audit | FluentUI, MSAL, build tools |
| JavaScript (Root) | package.json | npm audit | Azurite (dev only) |
Severity Rules
| Severity | Action | SLA |
|---|
| Critical | Investigate immediately, create issue | Same day |
| High | Investigate promptly, create issue | 3 business days |
| Medium | Queue for next sprint | Next sprint |
| Low | Document and track | Backlog |
Patterns & Techniques
Alert Triage Process
Step 1: Gather alerts
pip audit --format json
npm audit --json
Step 2: Group related vulnerabilities
- Same package, different CVEs → group together
- Same dependency chain → note the root cause package
- Transitive vs direct dependency → prioritize direct
Step 3: Assess HASTE impact
For each vulnerability, determine:
