菜单
Security scanning: dependency audits, SAST, secrets detection. Use when setting up Dependabot, CodeQL, or TruffleHog in CI, or creating a SECURITY.md policy.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/laurigates/claude-plugins --skill configure-security命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Install, configure and troubleshoot MCP servers. Use when adding/enabling servers, editing .mcp.json, fixing OAuth, or when a server runs stale code after an upstream fix.
FinOps snapshot — org billing, workflow stats, cache usage. Use when you want a high-level view of CI spending or workflow health before diving deeper.
GitHub Actions billing, workflow efficiency, and waste analysis at org or repo level. Use when investigating CI/CD costs, wasted runs, or optimizing triggers.
正在显示 SKILL.md
基于 SOC 职业分类
| created | "2025-12-16T00:00:00.000Z" |
| modified | "2026-07-04T00:00:00.000Z" |
| reviewed | "2026-07-04T00:00:00.000Z" |
| description | Security scanning: dependency audits, SAST, secrets detection. Use when setting up Dependabot, CodeQL, or TruffleHog in CI, or creating a SECURITY.md policy. |
| allowed-tools | Glob, Grep, Read, Write, Edit, Bash, AskUserQuestion, TodoWrite, WebSearch, WebFetch |
| args | [--check-only] [--fix] [--type <dependencies|sast|secrets|all>] |
| argument-hint | [--check-only] [--fix] [--type <dependencies|sast|secrets|all>] |
| name | configure-security |
Check and configure security scanning tools for dependency audits, SAST, and secret detection.
| Use this skill when... | Use another approach when... |
|---|---|
| Setting up dependency auditing, SAST, or secret detection for a project | Running a one-off security scan (use gitleaks detect or npm audit directly) |
| Checking project compliance with security scanning standards | Reviewing code for application-level vulnerabilities (use security-audit agent) |
| Configuring Dependabot, CodeQL, or TruffleHog in CI/CD | Managing GitHub repository security settings via the web UI |
| Creating or updating a SECURITY.md policy | Writing security documentation beyond the policy template |
| Auditing which security tools are missing from a project | Investigating a specific CVE or vulnerability |
find . -maxdepth 1 \( -name 'package.json' -o -name 'pyproject.toml' -o -name 'Cargo.toml' -o -name 'go.mod' \)find . -maxdepth 1 -name '.gitleaks.toml'find . -maxdepth 1 -name '.pre-commit-config.yaml'find . -maxdepth 2 -type d -path '*/.github/workflows'find . -maxdepth 2 -path '*/.github/dependabot.yml'find . -maxdepth 3 -path '*/.github/workflows/codeql*'find . -maxdepth 1 -name 'SECURITY.md'Security scanning layers:
Parse from command arguments:
--check-only: Report status without offering fixes--fix: Apply all fixes automatically without prompting--type <type>: Focus on specific security type (dependencies, sast, secrets, all)Execute this security scanning configuration check:
Verify latest versions before configuring:
Use WebSearch or WebFetch to verify current versions.
Run the detection script to scan the project for language signals and the three security layers (dependency auditing / SAST / secret detection) plus a SECURITY.md policy:
bash "${CLAUDE_SKILL_DIR}/scripts/configure-security.sh" --home-dir "$HOME" --project-dir "$(pwd)"
Parse STATUS= and the ISSUES: block from the output. The KEY=VALUE lines
report language detection (LANG_JS, LANG_PYTHON, LANG_RUST, LANG_GO) and
the presence matrix (DEPENDABOT, CODEQL, GITLEAKS_CONFIG, SECURITY_POLICY,
TRUFFLEHOG, DEPENDENCY_REVIEW, SECURITY_LAYERS_PRESENT).
Print a formatted compliance report showing status for each security component across dependency auditing, SAST scanning, secret detection, and security policies.
If --check-only is set, stop here.
For the compliance report format, see REFERENCE.md.
Based on detected language:
JavaScript/TypeScript (npm/bun):
package.json.github/dependabot.yml.github/workflows/dependency-review.ymlPython (pip-audit):
uv add --group dev pip-auditRust (cargo-audit):
cargo install cargo-audit --locked.cargo/audit.tomlFor complete configuration templates, see REFERENCE.md.
.github/workflows/codeql.yml with detected languagesuv run bandit -r src/ -f json -o bandit-report.jsonFor CodeQL workflow and Bandit configuration templates, see REFERENCE.md.
brew install gitleaks (or go install github.com/gitleaks/gitleaks/v8@latest).gitleaks.toml with project-specific allowlistsgitleaks detect --source ..pre-commit-config.yamlFor gitleaks, TruffleHog, and CI workflow configuration templates, see REFERENCE.md.
Create SECURITY.md from the template (supported-versions table, vulnerability
reporting process, report contents, best practices, automated-tools list) in
REFERENCE.md.
Create comprehensive security workflow .github/workflows/security.yml with jobs for:
Schedule weekly scans in addition to push/PR triggers.
For the CI security workflow template, see REFERENCE.md.
Update .project-standards.yaml with the security component keys. For the
exact block, see REFERENCE.md.
Print a summary of all changes made across dependency auditing, SAST scanning, secret detection, security policy, and CI/CD integration. Include next steps for reviewing Dependabot PRs, CodeQL findings, and enabling private vulnerability reporting.
For the results report format, see REFERENCE.md.
| Context | Command |
|---|---|
| Quick compliance check | /configure:security --check-only |
| Auto-fix all security gaps | /configure:security --fix |
| Dependencies only | /configure:security --type dependencies |
| Secret detection only | /configure:security --type secrets |
| SAST scanning only | /configure:security --type sast |
| Verify secrets scan | gitleaks detect --source . --verbose |
/configure:workflows - GitHub Actions workflow standards/configure:pre-commit - Pre-commit hook configuration/configure:all - Run all compliance checks