mcpField
S
security-scanning

security-scanning

github.com/bobmatnycSecurity78372 installsUpdated 15w ago
Repository

About security-scanning

A security-scanning skill that guides teams in assessing secrets, dependencies, SAST findings, and open-source component risk. It provides gating and exception practices for remediation workflows.

Key features

  1. 01Triage exposed secrets and rotation
  2. 02Gate dependencies by severity
  3. 03Introduce high-signal SAST checks
  4. 04Assess licenses, CVEs, and obsolescence
  5. 05Require reasons, owners, and expiry for exceptions

Use cases

  1. 01Setting dependency security gates
  2. 02Assessing third-party component risk
  3. 03Prioritizing vulnerability remediation
  4. 04Managing time-limited security exceptions

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bobmatnyc/claude-mpm-skills --skill security-scanning

After installing, type/security-scanningin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

metadata.json
references/
ci-workflows.md
common-findings-and-fixes.md
open-source-safety.md
supply-chain-and-sbom.md
tooling-matrix.md
triage-and-remediation.md

Details

From the project README

Security Scanning

Quick Start

  • Secrets: fail fast; rotate on exposure.
  • Dependencies: gate critical/high; automate updates.
  • SAST: start high-signal; ratchet over time.
  • Open Source Safety: score components on three axes — license tier, severity-weighted CVEs, obsolescence.
  • Exceptions: require reason, owner, and expiry.

Open Source Safety

Third-party component risk is more than "vulnerable: yes/no". Evaluate each component on three independent dimensions and gate on the worst:

  • License risk: HIGH = strong copyleft / GPL/AGPL/LGPL (whole-app disclosure risk); MEDIUM = weak copyleft / MPL, EPL (modification disclosure only); LOW = permissive / MIT, Apache-2.0, BSD. Unknown/NOASSERTION → treat as HIGH until identified.
  • CVE weighting: weight by severity (critical ≫ high ≫ medium ≫ low) rather than raw counts; critical/high block, medium/low track with owner + expiry.
  • Obsolescence: score the gap to latest version; majors-behind or unmaintained upstream is elevated risk.

See references/open-source-safety.md for the full framework, tier tables, the CVE weighting model, obsolescence scoring, and the transitive-dependency trust model.

Load Next (References)

  • references/tooling-matrix.md
  • references/ci-workflows.md
  • references/triage-and-remediation.md
  • references/common-findings-and-fixes.md
  • references/supply-chain-and-sbom.md
  • references/open-source-safety.md

Comments

Markdown supported