Security scanning: dependency audits, SAST, secrets detection. Use when setting up Dependabot, CodeQL, or TruffleHog in CI, or creating a SECURITY.md policy.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Security scanning: dependency audits, SAST, secrets detection. Use when setting up Dependabot, CodeQL, or TruffleHog in CI, or creating a SECURITY.md policy.
Use WebSearch or WebFetch to verify current versions.
Step 2: Detect project languages and security posture
Run the detection script to scan the project for language signals and the
three security layers (dependency auditing / SAST / secret detection) plus a
SECURITY.md policy:
Parse STATUS= and the ISSUES: block from the output. The KEY=VALUE lines
report language detection (LANG_JS, LANG_PYTHON, LANG_RUST, LANG_GO) and
the presence matrix (DEPENDABOT, CODEQL, GITLEAKS_CONFIG, SECURITY_POLICY,
TRUFFLEHOG, DEPENDENCY_REVIEW, SECURITY_LAYERS_PRESENT).
Step 3: Generate compliance report
Print a formatted compliance report showing status for each security component across dependency auditing, SAST scanning, secret detection, and security policies.
If --check-only is set, stop here.
For the compliance report format, see REFERENCE.md.
Step 4: Configure dependency auditing (if --fix or user confirms)
For complete configuration templates, see REFERENCE.md.
Step 5: Configure SAST scanning (if --fix or user confirms)
Create CodeQL workflow .github/workflows/codeql.yml with detected languages
For Python projects, install and configure Bandit
Run Bandit: uv run bandit -r src/ -f json -o bandit-report.json
For CodeQL workflow and Bandit configuration templates, see REFERENCE.md.
Step 6: Configure secret detection (if --fix or user confirms)
Install gitleaks: brew install gitleaks (or go install github.com/gitleaks/gitleaks/v8@latest)
Create .gitleaks.toml with project-specific allowlists
Run initial scan: gitleaks detect --source .
Add pre-commit hook to .pre-commit-config.yaml
Optionally configure TruffleHog workflow for CI
For gitleaks, TruffleHog, and CI workflow configuration templates, see REFERENCE.md.
Step 7: Create security policy
Create SECURITY.md from the template (supported-versions table, vulnerability
reporting process, report contents, best practices, automated-tools list) in
REFERENCE.md.
Step 8: Configure CI/CD integration
Create comprehensive security workflow .github/workflows/security.yml with jobs for:
Dependency audit
Secret scanning (TruffleHog)
SAST scan (CodeQL)
Schedule weekly scans in addition to push/PR triggers.
For the CI security workflow template, see REFERENCE.md.
Step 9: Update standards tracking
Update .project-standards.yaml with the security component keys. For the
exact block, see REFERENCE.md.
Step 10: Report configuration results
Print a summary of all changes made across dependency auditing, SAST scanning, secret detection, security policy, and CI/CD integration. Include next steps for reviewing Dependabot PRs, CodeQL findings, and enabling private vulnerability reporting.
