Guides security scanning (semgrep, grype, secret checks) and records actionable assessment results.
Guides security scanning (semgrep, grype, secret checks) and records actionable assessment results.
npx skills add https://github.com/kgrizz-git/DICOMViewerV3 --skill security-scanning-secops复制此命令并粘贴到 Claude Code 中以安装该技能
Run DICOM Viewer V3 agent smoke checks and manual UI smoke checklist after UX or loading changes. Use when verifying harness health, post-implementation smoke, or orchestrator requests manual smoke.
Defines safe multi-agent orchestration: delegation, sequencing, branch/worktree isolation, and release hygiene.
Runs test suites, tracks results in logs/test-ledger.md, and verifies tests promised in plans exist—without editing product code or tests. Use for tester subagent or when reporting pytest/jest/npm test outcomes.
Provides UX/UI evaluation standards using flows, screenshots, accessibility checks, and modern design guidance.
Workflow guidance for high-energy-physics Monte Carlo generation and analysis, including Pythia, MadGraph, and Feynman-diagram-driven studies.
Workflow guidance for Monte Carlo and deterministic radiation transport simulations (EM and particle transport), from geometry setup to validation and uncertainty reporting.
| name | security-scanning-secops |
| description | Guides security scanning (semgrep, grype, secret checks) and records actionable assessment results. |
| Concern | Example tool | Notes |
|---|---|---|
| Static analysis / bug patterns | semgrep | Use project config if present (.semgrep.yml). |
| Container / SBOM CVEs | grype | Point at image or SBOM; summarize critical/high. |
| CI/CD misuse, dangerous patterns | Review .github/workflows/ | Pin actions, least privilege, no plaintext secrets. |
| Repo secrets | trufflehog, gitleaks | Run read-only; redact findings in summaries. |
| Dependency advisories | osv-scanner, pip audit, npm audit | Use osv-scanner scan -r . for lockfiles/SBOMs. |
| Agent / MCP vulnerabilities | uvx snyk-agent-scan@latest | Use --skills flag to scan agent skills as well. |
Run only what is installed or available in the environment; if a tool is missing, say so and suggest install or CI addition—do not fabricate scan output.
security-assessment-YYYYMMDD-HHMM.md (UTC or local, be consistent) with executive summary, findings by severity, reproduction commands, and remediation order. To determine where to create this file, check repo for any subfolder matching security-assessments or safety-assessments or safety-scans or assessments, in that order. If none found, create assessments/ in the repo base.python-venv-dependencies when scans invoke Python-based CLIs.plans/orchestration-state.md.team-orchestration-delegation).