Guides security scanning (semgrep, grype, secret checks) and records actionable assessment results.
Guides security scanning (semgrep, grype, secret checks) and records actionable assessment results.
npx skills add https://github.com/kgrizz-git/DICOMViewerV3 --skill security-scanning-secops이 명령을 Claude Code에 복사하여 붙여넣어 스킬을 설치하세요
Run DICOM Viewer V3 agent smoke checks and manual UI smoke checklist after UX or loading changes. Use when verifying harness health, post-implementation smoke, or orchestrator requests manual smoke.
Defines safe multi-agent orchestration: delegation, sequencing, branch/worktree isolation, and release hygiene.
Runs test suites, tracks results in logs/test-ledger.md, and verifies tests promised in plans exist—without editing product code or tests. Use for tester subagent or when reporting pytest/jest/npm test outcomes.
Provides UX/UI evaluation standards using flows, screenshots, accessibility checks, and modern design guidance.
Workflow guidance for high-energy-physics Monte Carlo generation and analysis, including Pythia, MadGraph, and Feynman-diagram-driven studies.
Workflow guidance for Monte Carlo and deterministic radiation transport simulations (EM and particle transport), from geometry setup to validation and uncertainty reporting.
| name | security-scanning-secops |
| description | Guides security scanning (semgrep, grype, secret checks) and records actionable assessment results. |
| Concern | Example tool | Notes |
|---|---|---|
| Static analysis / bug patterns | semgrep | Use project config if present (.semgrep.yml). |
| Container / SBOM CVEs | grype | Point at image or SBOM; summarize critical/high. |
| CI/CD misuse, dangerous patterns | Review .github/workflows/ | Pin actions, least privilege, no plaintext secrets. |
| Repo secrets | trufflehog, gitleaks | Run read-only; redact findings in summaries. |
| Dependency advisories | osv-scanner, pip audit, npm audit | Use osv-scanner scan -r . for lockfiles/SBOMs. |
| Agent / MCP vulnerabilities | uvx snyk-agent-scan@latest | Use --skills flag to scan agent skills as well. |
Run only what is installed or available in the environment; if a tool is missing, say so and suggest install or CI addition—do not fabricate scan output.
security-assessment-YYYYMMDD-HHMM.md (UTC or local, be consistent) with executive summary, findings by severity, reproduction commands, and remediation order. To determine where to create this file, check repo for any subfolder matching security-assessments or safety-assessments or safety-scans or assessments, in that order. If none found, create assessments/ in the repo base.python-venv-dependencies when scans invoke Python-based CLIs.plans/orchestration-state.md.team-orchestration-delegation).