qa-security-scanning

Plugin qa-security-scanning from marketplace testland-qa in testland/qa. Commands read from the repo's manifest — today.

Skills (17)

• codeql-queries

  Use for any question or task about CodeQL or deep semantic static analysis (SAST) on a GitHub repo, including setting up code scanning and finding injection that flows through helper functions across files: codeql database create and analyze per language, query packs, SARIF upload to code scanning,

• cve-exploitability-triage

  Use when a dependency, image or SBOM scan returned more CVEs than the team can fix and someone must decide what to fix first. Ranks each CVE by EPSS exploit probability and CISA KEV status, applies VEX and reachability, and sorts findings into Fix-Now, This-Sprint, Backlog or Accept-Risk.

• dependabot-config

  Use for any question or task about Dependabot or .github/dependabot.yml, including grouping updates into one PR and taming too many update PRs: required keys, ecosystems, directories and schedules, plus ignore rules, grouped PRs, allow lists, labels, PR limits, target branches, versioning strategy a

• dependency-vulnerability-scanning

  Use when a repo needs dependency CVE scanning (SCA) in CI, a team is choosing between native audits (npm audit, pip-audit, cargo audit), OSV-Scanner and Snyk, or findings need triage. Scans lockfiles with thresholds, checks packages were seen, outputs SARIF and allows only expiring ignores.

• gitleaks-scanning

  Use when a team needs open-source secret scanning on commits and in CI, or is adopting it on a repo with existing leaks: gitleaks git, dir and stdin scans, custom rules and allowlists in .gitleaks.toml, pre-commit and GitHub Action setup, baselines, and TruffleHog live verification.

• language-native-sast

  Use when a repo needs security linting inside its own toolchain: Bandit for Python, gosec for Go, eslint-plugin-security and no-unsanitized for JavaScript/TypeScript, or PMD's Apex rules for Salesforce, with justified suppressions, baselines for legacy code, SARIF and CI gates.

• multi-tool-finding-triage

  Use when several security scanners (SAST, DAST, secrets, SCA, container, IaC) produce separate reports and the team needs one BLOCK or PASS. Normalizes and dedupes findings, records which scanners agree, rejects waivers without expiry or approver, adds EPSS and KEV, and writes one PR comment.

• nuclei-dast

  Use when a team runs ProjectDiscovery Nuclei for template-based web scanning, alongside or beyond ZAP: choosing templates by path, tag or severity, rate limits, JSONL output, custom YAML matchers for app-specific checks, community CVE templates and CI severity gates.

• reachability-analyzer

  Use whenever npm audit, OSV-Scanner or Snyk reports too many vulnerabilities and only the ones that matter should count. Finds dependencies the code never uses with knip or depcheck (JS), vulture (Python) or cargo-machete (Rust) and downranks their CVEs. EPSS and KEV: cve-exploitability-triage.

• renovate-config

  Use when writing or reviewing renovate.json for Mend Renovate on GitHub, GitLab, Bitbucket, Azure DevOps or Gitea: preset extends, schedules, PR limits, vulnerability alerts, packageRules matching with automerge, ignored dependencies and labels.

• secrets-rotation-runner

  Use for any question or task about a leaked secret, API key or token found in code or git history, including what to do next and whether scrubbing history is enough (it is not), or scheduled rotation: identify the provider, rotate the credential through its API (AWS IAM, GitHub, Stripe, GCP, Azure,

• semgrep-rules

  Use for any question or task about Semgrep, writing a rule that flags a code pattern, or a lighter static analysis (SAST) gate than CodeQL that needs no code database: Registry rulesets and custom YAML rules, semgrep ci with diff-aware baselines, nosemgrep suppressions, path filters, severity filter

• sonarqube-rules

  Use when a team runs SonarQube or SonarCloud for multi-language static analysis and code quality: sonar-scanner and sonar-project.properties, Sonar Way profiles and custom rules, quality gates on new code, branch and PR analysis, and NOSONAR or SuppressWarnings suppressions.

• syft-generation

  Use for any question or task about SBOMs, including generating one for a container image or folder, adding SBOM generation and vulnerability scanning to a release job, compliance (US EO 14028, EU CRA, FDA) or drift between releases. Generates CycloneDX or SPDX SBOMs with Syft, scans them with Grype,

• trivy-image

  Use for any question or task about scanning a container or Docker image for vulnerabilities, secrets, misconfigurations or licenses, including failing CI only on fixable critical CVEs and base-image CVEs with no fix: trivy image with severity filters, SARIF or JSON output, .trivyignore suppressions,

• vex-author

  Use when a scanner flags a CVE that analysis shows is not exploitable in your product, and a machine-readable assertion is needed instead of deleting the finding. Writes and validates OpenVEX statements (not_affected, affected, fixed, under_investigation) with vexctl and attaches them to images.

• zap-baseline

  Use when a web app needs OWASP ZAP scanning before production: the Docker baseline passive scan as a CI gate, the full active scan for staging, the Ajax spider for SPAs, scans behind a login (forms, JSON, OAuth or bearer tokens) and a rollout plan from PR baseline to nightly active scans.

Subagents (1)

• security-finding-triager

  Use proactively whenever several security scanners (SAST, DAST, secrets, SCA, container or SBOM, IaC) ran on a PR and it needs one decision. Normalizes and dedupes findings, enforces waivers with expiry and approver, adds EPSS and CISA KEV, and posts one PR comment with a BLOCK or PASS per domain.

Similar plugins