security-scanning

Automated security scanning pipeline covering SAST (Semgrep), SCA (OWASP dependency-check), SBOM generation (Syft), vulnerability scanning (Grype), and secrets detection (detect-secrets). Invoked by security-architect for pre-commit gates, CI integration, and finding triage.

仓库: oimiragieo/agent-studio
最近来源活动: 2026年4月21日 23:45
检测到的 SKILL.md 语言: 英语
星标: 36
分支: 6

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

返回搜索返回安装

name	security-scanning
description	Automated security scanning pipeline covering SAST (Semgrep), SCA (OWASP dependency-check), SBOM generation (Syft), vulnerability scanning (Grype), and secrets detection (detect-secrets). Invoked by security-architect for pre-commit gates, CI integration, and finding triage.
version	1.0.0
category	security
agents	["security-architect","devops","qa"]
tools	["Bash","Read","Write","Grep"]
source	builtin
trust_score	100
provenance_sha	c6195cf3c263847d

Security Scanning Skill

Automated security scanning pipeline: SAST, SCA, SBOM, and secrets detection.

Tools

Tool	Purpose	Install
Semgrep	SAST — static analysis	`pip install semgrep`
OWASP dependency-check	SCA — known CVEs in deps	`brew install dependency-check`
Syft	SBOM generation	`brew install anchore/syft/syft`
Grype	Vulnerability scanner (uses SBOM)	`brew install anchore/grype/grype`
detect-secrets	Secrets detection	`pip install detect-secrets`

Phase 1: SAST — Static Analysis (Semgrep)

# Run default ruleset
semgrep --config auto .

# Run security-focused rules only
semgrep --config p/security-audit .

# Run OWASP Top 10 rules
semgrep --config p/owasp-top-ten .

# Output JSON for CI
semgrep --config auto --json --output semgrep-results.json .

# Fail CI on any HIGH or CRITICAL finding
semgrep --config auto --severity ERROR .

Recommended rulesets:

p/security-audit — broad security audit
p/owasp-top-ten — OWASP Top 10 coverage
p/javascript — JS/TS patterns (injection, XSS, prototype pollution)
p/python — Python patterns (SQL injection, insecure deserialization)
p/secrets — hardcoded credential detection

Phase 2: SCA — Software Composition Analysis (OWASP dependency-check)

# Scan Node.js project
dependency-check --project myapp --scan . --format JSON --out dependency-check-report

# Scan with NVD API key (avoids rate limiting)
dependency-check --project myapp --scan . \
  --nvdApiKey "$NVD_API_KEY" \
  --format HTML --out reports/

# CI integration: fail on CVSS >= 7.0
dependency-check --project myapp --scan . \
  --failOnCVSS 7 \
  --format JSON --out reports/


dependency-check --project myapp --scan . \
  --suppression suppressions.xml

# Generate SBOM for current directory
syft . -o spdx-json > sbom.spdx.json

# SBOM from Docker image
syft my-image:latest -o cyclonedx-json > sbom.cyclonedx.json

# Multiple formats
syft . -o spdx-json -o cyclonedx-json -o syft-json

# Sign SBOM with cosign
cosign attest --predicate sbom.spdx.json --type spdx $IMAGE_DIGEST

# Scan from SBOM
grype sbom:sbom.spdx.json

# Scan Docker image directly
grype my-image:latest

# Scan current directory
grype .

# Fail on CRITICAL or HIGH
grype sbom:sbom.spdx.json --fail-on high

# Output JSON for CI
grype sbom:sbom.spdx.json -o json > grype-results.json

# Filter by severity
grype sbom:sbom.spdx.json --only-fixed

# Create baseline (initial scan)
detect-secrets scan > .secrets.baseline

# Audit baseline interactively
detect-secrets audit .secrets.baseline

# Scan for new secrets (CI check)
detect-secrets scan --baseline .secrets.baseline

# Add to pre-commit hook
# .pre-commit-config.yaml:
# - repo: https://github.com/Yelp/detect-secrets
#   rev: v1.4.0
#   hooks:
#   - id: detect-secrets
#     args: ['--baseline', '.secrets.baseline']

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/returntocorp/semgrep
    rev: v1.58.0
    hooks:
      - id: semgrep
        args: ['--config', 'p/security-audit', '--error']

  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']

# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: SAST (Semgrep)
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/security-audit

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          format: spdx-json
          output-file: sbom.spdx.json

      - name: Vulnerability Scan (Grype)
        uses: anchore/scan-action@v3
        with:
          sbom: sbom.spdx.json
          fail-build: true
          severity-cutoff: high

      - name: Secrets Detection
        run: |
          pip install detect-secrets
          detect-secrets scan --baseline .secrets.baseline

HIGH/CRITICAL findings:
  → Create security issue immediately
  → Assign to security-architect for review
  → Block merge until resolved or suppressed with justification

MEDIUM findings:
  → Log in security backlog
  → Review in next sprint
  → Add to suppression file with justification if false positive

LOW/INFO findings:
  → Weekly review
  → Suppress with justification or accept risk

# nosemgrep: python.lang.security.audit.hardcoded-password.hardcoded-password
PASSWORD = os.environ["PASSWORD"]

# Mark as false positive during audit
detect-secrets audit .secrets.baseline
# Press 'n' to mark as not a secret

ignore:
  - vulnerability: CVE-2021-44228
    reason: 'Not affected — log4j not in classpath'

Anti-Pattern	Why It Fails	Correct Approach
Skipping SCA for "known" deps	CVEs are discovered continuously	Always run SCA; pin versions + audit
Suppressing all Semgrep findings	Breaks the safety net	Suppress only with justification + owner
Not rotating detected secrets	Secret is already compromised	Rotate immediately, then suppress
SBOM generated but not scanned	SBOM alone adds no security value	Always run Grype against generated SBOM
Scanning only in CI	Developers get slow feedback loop	Add pre-commit hooks for SAST + secrets