About

Imported from bobmatnyc/claude-mpm-skills (universal/security/security-scanning/SKILL.md). Install upstream with npx skills add bobmatnyc/claude-mpm-skills --skill security-scanning. Copyright stays with the author (MIT).

Security Scanning

Name: security-scanning
Author: bobmatnyc

Quick Start

Secrets: fail fast; rotate on exposure.
Dependencies: gate critical/high; automate updates.
SAST: start high-signal; ratchet over time.
Open Source Safety: score components on three axes — license tier, severity-weighted CVEs, obsolescence.
Exceptions: require reason, owner, and expiry.

Open Source Safety

Third-party component risk is more than "vulnerable: yes/no". Evaluate each component on three independent dimensions and gate on the worst:

License risk: HIGH = strong copyleft / GPL/AGPL/LGPL (whole-app disclosure risk); MEDIUM = weak copyleft / MPL, EPL (modification disclosure only); LOW = permissive / MIT, Apache-2.0, BSD. Unknown/NOASSERTION → treat as HIGH until identified.
CVE weighting: weight by severity (critical ≫ high ≫ medium ≫ low) rather than raw counts; critical/high block, medium/low track with owner + expiry.
Obsolescence: score the gap to latest version; majors-behind or unmaintained upstream is elevated risk.

See references/open-source-safety.md for the full framework, tier tables, the CVE weighting model, obsolescence scoring, and the transitive-dependency trust model.

Load Next (References)

references/tooling-matrix.md
references/ci-workflows.md
references/triage-and-remediation.md
references/common-findings-and-fixes.md
references/supply-chain-and-sbom.md
references/open-source-safety.md

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/bobmatnyc-claude-mpm-skills-security-scanning/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

bobmatnyc-claude-mpm-skills-security-scanning.ocm.jsonjson

{
  "ocm": "1",
  "id": "bobmatnyc-claude-mpm-skills-security-scanning",
  "kind": "skill",
  "name": "security-scanning",
  "description": "CI security scanning: secrets, deps, SAST, triage, expiring exceptions",
  "publisher": "bobmatnyc",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "security",
      "scanning",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "CI security scanning: secrets, deps, SAST, triage, expiring exceptions"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/bobmatnyc/claude-mpm-skills",
      "path": "universal/security/security-scanning/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/bobmatnyc/claude-mpm-skills/blob/HEAD/universal/security/security-scanning/SKILL.md",
      "key": "bobmatnyc/claude-mpm-skills/universal/security/security-scanning/SKILL.md"
    },
    "compatibility": "claude-code",
    "license": "MIT"
  },
  "instructions": "# Security Scanning\n\n## Quick Start\n\n- Secrets: fail fast; rotate on exposure.\n- Dependencies: gate critical/high; automate updates.\n- SAST: start high-signal; ratchet over time.\n- Open Source Safety: score components on three axes — license tier, severity-weighted CVEs, obsolescence.\n- Exceptions: require reason, owner, and expiry.\n\n## Open Source Safety\n\nThird-party component risk is more than \"vulnerable: yes/no\". Evaluate each component on\nthree independent dimensions and gate on the worst:\n\n- **License risk:** HIGH = strong copyleft / GPL/AGPL/LGPL (whole-app disclosure risk);\n  MEDIUM = ",
  "cost": {
    "context_tokens": 361
  }
}

Fetch it by URL: GET /api/v1/registry/bobmatnyc-claude-mpm-skills-security-scanning/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.