security-vulnerability-report

name	security-vulnerability-report
description	Scan GitHub repositories for security vulnerabilities including Dependabot alerts, code scanning results, and secret scanning findings. Use when auditing repository security, preparing compliance reports, or triaging vulnerability alerts. Use when this capability is needed.
metadata	{"author":"cnoe-io"}

Security Vulnerability Report

Query GitHub for Dependabot alerts, code scanning results, and secret scanning findings across repositories to produce a prioritized vulnerability report.

Instructions

Phase 1: Dependabot Alerts (GitHub Agent)

1. Fetch Dependabot alerts across all configured repositories
   • Alert severity, affected package, CVE identifier, fix availability

Phase 2: Code Scanning Results (GitHub Agent)

1. Fetch code scanning alerts - rule ID, severity, file location

Phase 3: Secret Scanning (GitHub Agent)

1. Check for secret scanning alerts - secret type, revocation status

Phase 4: Compile Report

1. Aggregate across repositories with cross-repo dedup
2. Prioritize by severity, exploitability, fix availability
3. Calculate risk score per repository

Output Format

```markdown

Security Vulnerability Report

Executive Summary

Severity	Open	Fixed (30d)	Dismissed
Critical	2	5	0
High	7	12	1

Critical Vulnerabilities (Immediate Action Required)

1. CVE-2026-1234 - Remote Code Execution in lodash

• Repository: ai-platform-engineering/ui
• CVSS: 9.8 | Fix: Upgrade to lodash@4.17.22 ```

Examples

• "Check all repositories for security vulnerabilities"
• "Show me critical Dependabot alerts"
• "Are there any secret scanning findings?"
• "Generate a security report for the ai-platform-engineering repo"

Guidelines

• Always sort by severity (critical first), then by fix availability
• Flag any vulnerabilities with known exploits in the wild as top priority
• Deduplicate shared dependencies across repos
• Never display actual secret values in the report - only the type and location
• Reference project codeguard rules: no hardcoded credentials, no banned crypto algorithms

---

Source: cnoe-io/ai-platform-engineering — distributed by TomeVault.