18 skills · sorted by relevance
Scan code, dependencies, containers, IaC and SBOMs with Snyk via its first-party MCP server: authenticate, trust a folder, run the right scanner, read the findings, fix and re-scan. Includes package-health checks before adding a dependency.
The English summary is being prepared. Showing the original description.
Scan code, dependencies, containers, IaC and SBOMs with Snyk via its first-party MCP server: authenticate, trust a folder, run the right scanner, read the findings, fix and re-scan. Includes package-health checks before adding a dependency.
The English summary is being prepared. Showing the original description.
Use when working with Snyk — snyk security scanning and vulnerability analysis. Covers dependency vulnerability scanning, container image scanning, IaC security scanning, code analysis, license compliance, and fix recommendations. Use when scanning for vulnerabilities, analyzing dependency risks, reviewing container security, or auditing IaC configurations.
The English summary is being prepared. Showing the original description.
Check third-party packages for known security vulnerabilities, review dependency versions and lock files, and plan updates or replacements. The skill also guides automated scanning in CI, the pipeline that runs project checks.
Expert en sécurité des conteneurs (Trivy, Snyk, image scanning, SBOM, runtime security, DZ)
The English summary is being prepared. Showing the original description.
Review security measures in Java Spring Boot services, including identity checks, access permissions, input validation, and secret storage. Provides configuration examples and a release checklist covering API request limits, browser protections, logging, and dependency vulnerabilities.
Assess software dependencies, build pipelines, and container images for security risks. Create a software component inventory, check vulnerabilities and license conflicts, verify artifact signatures, and prioritize fixes based on whether vulnerable code can actually be reached.
Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check. Identify and remediate vulnerable libraries in your software supply chain. Use when managing third-party dependencies or implementing software composition analysis.
The English summary is being prepared. Showing the original description.
Generate prioritized CVE watchlists and actionable security recommendations for repositories. Use when analyzing CVE scan results, creating security reports, prioritizing vulnerability remediation, or generating security gate reports for CI/CD. Takes CVE scan results (JSON/SARIF from npm audit, pip-audit, Snyk), reachability analysis, and cutoff date as input. Combines severity, reachability, exploitability, and dependency criticality to rank CVEs by practical risk. Outputs markdown reports with concrete next-step guidance (immediate upgrade, monitor, ignore with justification, apply mitigation) suitable for issue trackers, security reviews, and CI security gates.
The English summary is being prepared. Showing the original description.
Automated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit. Use for CI/CD security gates, pre-deployment audits, compliance requirements, or encountering CVE detection, outdated packages, license compliance, SBOM generation errors.
The English summary is being prepared. Showing the original description.
Use when semgrep, osv-scanner, github-security or snyk MCP tools appear in your tool list - what each server is for, how to call it safely, what data leaves the machine, and how its findings are triaged
The English summary is being prepared. Showing the original description.
Discoverability shim for the Retail-Agentic-Commerce CVE remediation Codex skill. Use for CVE, BDSA, GHSA, OSV, Dependabot, Black Duck, Snyk, npm, PyPI, or package advisory remediation.
The English summary is being prepared. Showing the original description.
Dependency vulnerability remediation workflow for this repository. Use when fixing CVE, BDSA, GHSA, OSV, npm, PyPI, Dependabot, Black Duck, Snyk, or other package vulnerability findings, especially when the user asks for minimal package-only updates, validation, commits, branches, or pull requests.
The English summary is being prepared. Showing the original description.
供应链安全时使用。适用于依赖漏洞扫描 / 镜像安全 / CI 投毒防护 / SBOM。融合 SLSA + Sigstore + Snyk + Trivy。
The English summary is being prepared. Showing the original description.
依赖安全审计时使用。覆盖 npm audit / Snyk / Trivy / 密钥扫描 / 容器扫描。
The English summary is being prepared. Showing the original description.
Guideline for designing, implementing, and verifying secure TypeScript and JavaScript applications following OWASP Top 10 best practices. Use when the user wants to: (1) review TypeScript or JavaScript code for security vulnerabilities, (2) design a secure Node.js, Deno, or browser application architecture, (3) implement security features (authentication, authorization, cryptography, input validation), (4) audit npm/yarn/pnpm dependencies for known vulnerabilities, (5) create security checklists or verification plans, (6) fix security bugs or harden existing TypeScript or JavaScript code, (7) set up security testing and static analysis (ESLint security plugins, Semgrep, Snyk), or (8) handle any TypeScript/JavaScript security concern including injection prevention, prototype pollution, XSS protection, SSRF prevention, secrets management, and secure deployment.
The English summary is being prepared. Showing the original description.
Security audit orchestrator for agent skills — scans for prompt injection, data exfiltration, credential theft, supply chain risks, and instruction hierarchy violations before any skill is installed, created, improved, or read from a GitHub repo. Load when creating skills from external sources, when improve-skills reads from GitHub repos, when research-skill fetches community SKILL.md files, when a user installs a third-party skill, or when the user asks to audit skill security, scan for injection, check if a skill is safe, scan all skills, or run a security sweep. Orchestrates all secure-* skills in sequence. Content is SAFE only if ALL secure-* skills return SAFE. 36% of community skills contain flaws (Snyk ToxicSkills 2026). This skill is the first line of defense.
The English summary is being prepared. Showing the original description.
Turns npm audit/Snyk results into prioritized patch plans with severity assessment, safe upgrade paths, breaking change analysis, and rollback strategies. Use for "dependency security", "vulnerability patching", "npm audit", or "security updates".
The English summary is being prepared. Showing the original description.