security-vulnerability-report

name	security-vulnerability-report
description	Scan GitHub repositories for security vulnerabilities including Dependabot alerts, code scanning results, and secret scanning findings. Use when auditing repository security, preparing compliance reports, or triaging vulnerability alerts.

Security Vulnerability Report

Query GitHub for Dependabot alerts, code scanning results, and secret scanning findings across repositories to produce a prioritized vulnerability report.

Instructions

Phase 1: Dependabot Alerts (GitHub Agent)

1. Fetch Dependabot alerts across all configured repositories:
   • Alert severity (critical, high, medium, low)
   • Affected package and vulnerable version range
   • Patched version available (yes/no)
   • CVE identifier and CVSS score
   • Ecosystem (npm, pip, go, etc.)
   • Alert state (open, dismissed, fixed)

Phase 2: Code Scanning Results (GitHub Agent)

1. Fetch code scanning alerts:
   • Rule ID and description
   • Severity and confidence
   • Affected file and line number
   • Tool that detected it (CodeQL, etc.)
   • Alert state and dismissal reason if applicable

Phase 3: Secret Scanning (GitHub Agent)

1. Check for secret scanning alerts:
   • Secret type (API key, token, password, etc.)
   • Affected file and commit
   • Whether the secret has been revoked
   • Alert state

Phase 4: Compile Report

1. Aggregate across repositories with cross-repo dedup for shared dependencies
2. Prioritize by:
   • Severity (critical first)
   • Exploitability (known exploits in the wild)