harness-sast-and-sca

Plugin harness-sast-and-sca from marketplace harness-sast-and-sca-plugins in ShiftLeftSecurity/claude-plugins. Commands read from the repo's manifest — 5 days ago.

Skills (10)

• autofix-vuln

  Request or fetch Qwiet recommended fixes and branch autofixes. Invoke when the user runs /autofix-vuln or explicitly asks for cloud AutoFix after triage. Do NOT use for local PostToolUse hook findings — fix those in the editor. Do NOT call sl_get_recommended_fix* without this skill active.

• create-custom-policy

  Create and validate a custom Harness SAST `.policy` file. Invoke when the user runs /create-custom-policy or asks to add a policy (e.g. audit logging for private data, insufficient logging). Scaffold, author, and validate locally — use /deploy-custom-policy for push and assignment.

• curness

  Run local Harness SAST on source files, or SCA on dependency manifests. Use when the user asks to scan code, check dependencies or CVEs, or mentions Harness SAST and SCA, Curness, security scanning, Review, Analyze, Qwiet, or ShiftLeft.

• deploy-custom-policy

  Validate then upload a custom Harness SAST `.policy`. Bare /deploy-custom-policy only validates and asks; push and assignment require an explicit user reply. Invoke when the user runs /deploy-custom-policy or asks to upload, publish, push, or assign a policy after local validation.

• run-security-scan

  Run code analysis via sl analyze or look up package CVEs (Intelligent SCA) via Qwiet. Invoke when the user runs /run-security-scan or explicitly asks for a cloud upload scan. Do NOT use for local PostToolUse hook findings, triage, or autofix — fix hook findings in the editor; use /triage-vuln and /a

• curness

  Run local Harness SAST on source files, or SCA on dependency manifests. Use when the user asks to scan code, check dependencies or CVEs, or mentions Harness SAST and SCA, Curness, security scanning, Review, Analyze, Qwiet, or ShiftLeft.

• setup-harness-code-security-mcp

  Install and verify the harness-code-security-mcp npm MCP server. Use when sl_* MCP tools are missing, setup is requested, or Qwiet auth needs diagnosis. After first-time MCP config, tell the user to restart the agent host before calling sl_* tools.

• triage-vuln

  List and explain findings from a scan with data flow. Invoke when the user runs /triage-vuln or says triage, review findings, or investigate finding ids after a scan. Do NOT satisfy triage by calling sl_* tools without this skill active; run /triage-vuln first.

• update-harness-sast-dependencies

  Install or update Harness SAST and SCA engine dependencies (analyzers and dependency tooling). Use when the user asks to update the security tools, install missing dependencies, or check for updates.

• update

  Install or update Harness SAST and SCA engine dependencies (analyzers and dependency tooling). Use when the user asks to update the security tools, install missing dependencies, or check for updates.

MCP servers (1)

• slmcp

  runs: node ${CLAUDE_PLUGIN_ROOT}/slmcp/slmcp.cjs

Hooks (5)

• SessionStart

  node "${CLAUDE_PLUGIN_ROOT}/handlers/session-start-handler.js"

• SessionEnd

  node "${CLAUDE_PLUGIN_ROOT}/handlers/session-end-handler.js"

• PreToolUse

  node "${CLAUDE_PLUGIN_ROOT}/handlers/claude-code-pretooluse-handler.js"

• PostToolUse

  node "${CLAUDE_PLUGIN_ROOT}/handlers/claude-code-hook-handler.js"

• Stop

  node "${CLAUDE_PLUGIN_ROOT}/handlers/claude-code-stop-handler.js"