github-security-report

Plugin github-security-report from marketplace github-security-report-plugin in yu-iskw/github-security-report-plugin. Commands read from the repo's manifest — 1 month ago.

Skills (8)

• aggregate-security-report

  Merge normalized envelopes from fetch-dependabot-alerts, fetch-code-scanning-alerts, and fetch-secret-scanning-alerts into one JSON summary and Markdown report. Use after fetch skills complete. Does not call gh.

• fetch-code-scanning-alerts

  List and normalize code scanning alerts (CodeQL, SARIF) for a GitHub organization or repository using gh api. Use when the user asks for code scanning, SAST, or CodeQL alerts for an org or repo.

• fetch-dependabot-alerts

  List and normalize Dependabot alerts for a GitHub organization or repository using gh api. Use when the user asks for dependency vulnerabilities, Dependabot alerts, GHSA, or CVE data for an org or repo.

• fetch-secret-scanning-alerts

  List and normalize secret scanning alerts for a GitHub organization or repository using gh api. Use when the user asks for leaked secrets, secret scanning, or token exposure for an org or repo.

• gh-auth-security

  Check GitHub CLI authentication and scopes for security alert APIs. Use when gh api security endpoints return 403/404 or before fetching Dependabot, code scanning, or secret scanning alerts.

• security-auth

  Check gh auth and org access before security fetches. Use when gh returns 403/404 or before first report on an org.

• security-repo-report

  Security report for one repository (all three alert types). Use when the user names owner/repo.

• security-report

  Full org security report (Dependabot, code scanning, secret scanning). Use when the user wants an organization security overview or open-alert summary.

Subagents (1)

• security-report-orchestrator

  Produce an integrated GitHub organization security report for any org the user specifies. Applies fetch-* skills and aggregate-security-report. Use when the user asks for a security overview, alert summary, or org/repo security report.