security-scanning — Claude Code skill: what it does, how to install
Sets up CI security scanning across secrets, SAST, license tiers, and outdated dependencies. Useful when establishing baseline checks and tracking expiring exceptions.
npx skills add bobmatnyc/claude-mpm-skills --skill security-scanning -a claude-codeWhat security-scanning does
This skill establishes baseline security policies for CI pipelines. It targets leaked secrets, static code analysis, and third-party dependencies. Secret exposures fail builds immediately. SAST rules start with high-signal alerts and ratchet up over time.
Open source risks are evaluated across three dimensions rather than simple vulnerability checks. The framework inspects license exposure, severity-weighted CVE scores, and package obsolescence. Strong copyleft licenses like GPL trigger high risk warnings. Any component with an unknown license or NOASSERTION status is classified as high risk immediately.
Critical and high vulnerabilities halt the pipeline. When teams need exceptions, every bypass must specify a clear reason, an assigned owner, and an expiration date. Additional reference files cover tooling matrices, SBOM structures, and remediation steps.
What it helps with
- block CI builds immediately on detected secret leaks
- filter dependencies by severity-weighted CVE scores
- identify license risks from strong copyleft components
- formalize security exceptions with owners and expiration dates
Example prompts for the agent
- Review our CI pipeline against baseline secret and dependency scanning rules
- Help me create a temporary vulnerability exception with an owner and expiration
- Evaluate the risks of adding a component licensed under MPL
How to install security-scanning
1Skills CLI (Vercel)
npx skills add bobmatnyc/claude-mpm-skills --skill security-scanning -a claude-code2Manually: put the files in place
~/.claude/skills/security-scanning/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-scanning/
1Skills CLI (Vercel)
npx skills add bobmatnyc/claude-mpm-skills --skill security-scanning -a codex2Manually: put the files in place
.agents/skills/security-scanning/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add bobmatnyc/claude-mpm-skills --skill security-scanning -a cursor2Manually: put the files in place
.cursor/skills/security-scanning/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install bobmatnyc/claude-mpm-skills security-scanning2Manually: put the files in place
.github/skills/security-scanning/SKILL.md1Skills CLI (Vercel)
npx skills add bobmatnyc/claude-mpm-skills --skill security-scanning -a gemini-cli2Platform CLI
gemini skills install https://github.com/bobmatnyc/claude-mpm-skills --path universal/security/security-scanningManually: put the files in place
.devin/skills/security-scanning/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add bobmatnyc/claude-mpm-skills --skill security-scanning -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about security-scanning
How to install security-scanning in Claude Code?
Run npx skills add bobmatnyc/claude-mpm-skills --skill security-scanning -a claude-code. The skill file will be placed in ~/.claude/skills/security-scanning/SKILL.md.
What does the security-scanning skill do?
It supplies guidelines for configuring automated CI security steps. The instructions cover leaked secrets, SAST setup, dependency triage, and license verification.
How does the skill handle vulnerability exceptions?
Security exceptions cannot be permanent or unassigned. Every exception requires a documented reason, an accountable owner, and a fixed expiration date.
Source text
SKILL.md · MIT
---
name: security-scanning
description: "CI security scanning: secrets, deps, SAST, triage, expiring exceptions"
user-invocable: false
disable-model-invocation: true
license: MIT
compatibility: claude-code
metadata:
version: 1.2.0
category: universal
author: Claude MPM Team
updated: "2026-06-15"
progressive_disclosure:
entry_point:
summary: "Baseline CI scans (secrets, deps, SAST) with triage and expiring exceptions"
tags: [security, scanning]
---
# Security Scanning
## Quick Start
- Secrets: fail fast; rotate on exposure.
- Dependencies: gate critical/high; automate updates.
- SAST: start high-signal; ratchet over time.
- Open Source Safety: score components on three axes — license tier, severity-weighted CVEs, obsolescence.
- Exceptions: require reason, owner, and expiry.
## Open Source Safety
Third-party component risk is more than "vulnerable: yes/no". Evaluate each component on
three independent dimensions and gate on the worst:
- **License risk:** HIGH = strong copyleft / GPL/AGPL/LGPL (whole-app disclosure risk);
MEDIUM = weak copyleft / MPL, EPL (modification disclosure only); LOW = permissive /
MIT, Apache-2.0, BSD. Unknown/`NOASSERTION` → treat as HIGH until identified.
- **CVE weighting:** weight by severity (critical ≫ high ≫ medium ≫ low) rather than raw
counts; critical/high block, medium/low track with owner + expiry.
- **Obsolescence:** score the gap to latest version; majors-behind or unmaintained
upstream is elevated risk.
See `references/open-source-safety.md` for the full framework, tier tables, the CVE
weighting model, obsolescence scoring, and the transitive-dependency trust model.
## Load Next (References)
- `references/tooling-matrix.md`
- `references/ci-workflows.md`
- `references/triage-and-remediation.md`
- `references/common-findings-and-fixes.md`
- `references/supply-chain-and-sbom.md`
- `references/open-source-safety.md`
© Claude MPM Team · MIT · bobmatnyc/claude-mpm-skills
