| name | agentic-security:security-scan-on-deploy |
| description | Run the security scanner. Activate on ship / deploy / launch / "is this safe?" — before the deploy happens. |
Skill — scan before deploy
Activates when the user is about to push code to production, asks if their
project is safe to ship, or mentions any of the destructive-prone deploy
commands (vercel --prod, fly deploy, wrangler publish, npm publish,
gh pr merge --auto).
When to fire
- User says "I'm about to deploy" / "is this safe to ship?" / "ready to launch?"
- User runs (or asks you to run) a production-deploy command via Bash.
- Conversation references go-live, GA, beta launch, customer migration.
- Right after a session-long feature build, before the merge.
What to do
-
Check for fresh scan state. Read
.agentic-security/last-scan.json mtime. If it's older than
24 hours OR doesn't exist, run a fresh scan first:
/scan --all for the full surface, or /scan --uncommitted if
the user only edited a few files.
-
Render the verdict, not the wall of findings. The user is
making a deploy decision, not auditing. Lead with:
- Safe to deploy — no critical/high findings → say so in one
line, mention the streak, offer
/compliance --attestation to
generate the badge.
- Critical findings present — refuse to bless the deploy.
Show the top 3 by exploitability, route to
/fix --all --critical for batch remediation, or recommend wiring the
CI bench gate so blocking is automatic next time.
- High but no critical — show count, recommend triage via
/triage --show --all before deploy, mention the deploy is
still possible but flag the risk.
-
Surface the production-aware filters. If /scan --exposed-only
has been configured (WAF / auth-middleware / network-policy
ingest), use it. A finding the WAF already blocks shouldn't
block the deploy.
-
Offer one-finding triage flow. If there's one blocker,
suggest:
/triage --explain <id> → /fix --one <id> → re-scan → ship.
Don't just list the finding and walk away.
Don't
- Don't bless a deploy with critical findings open.
- Don't drown the user in 80 medium-severity findings when they
asked "safe to ship?". They want the verdict.
- Don't run the scanner on every "deploy" mention — check the
.agentic-security/last-scan.json mtime first; reuse if fresh.
Canonical commands
/scan --all — full sweep/scan --uncommitted — only the user's recent edits/secure — vibecoder router; figures out the right next action/compliance --attestation — generate the badge / deploy-ready attestation/find-and-fix-everything — batch remediation pass before deploy
