agentsclimarketplace
Sign in

Security scan on deploy

Skill Clear-Capabilities/agentic-security/skills/security-scan-on-deploy

Run the security scanner. Activate on ship / deploy / launch / "is this safe?" — before the deploy happens.From its SKILL.md

Install
npx -y skills add Clear-Capabilities/agentic-security --skill security-scan-on-deploy

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.

SKILL.md

2.7 KB, as published. Nobody here has run it

Skill — scan before deploy

Activates when the user is about to push code to production, asks if their project is safe to ship, or mentions any of the destructive-prone deploy commands (vercel --prod, fly deploy, wrangler publish, npm publish, gh pr merge --auto).

When to fire

  • User says "I'm about to deploy" / "is this safe to ship?" / "ready to launch?"
  • User runs (or asks you to run) a production-deploy command via Bash.
  • Conversation references go-live, GA, beta launch, customer migration.
  • Right after a session-long feature build, before the merge.

What to do

  1. Check for fresh scan state. Read .agentic-security/last-scan.json mtime. If it's older than 24 hours OR doesn't exist, run a fresh scan first: /scan --all for the full surface, or /scan --uncommitted if the user only edited a few files.

  2. Render the verdict, not the wall of findings. The user is making a deploy decision, not auditing. Lead with:

    • Safe to deploy — no critical/high findings → say so in one line, mention the streak, offer /compliance --attestation to generate the badge.
    • Critical findings present — refuse to bless the deploy. Show the top 3 by exploitability, route to /fix --all --critical for batch remediation, or recommend wiring the CI bench gate so blocking is automatic next time.
    • High but no critical — show count, recommend triage via /triage --show --all before deploy, mention the deploy is still possible but flag the risk.

  3. Surface the production-aware filters. If /scan --exposed-only has been configured (WAF / auth-middleware / network-policy ingest), use it. A finding the WAF already blocks shouldn't block the deploy.

  4. Offer one-finding triage flow. If there's one blocker, suggest: /triage --explain <id> → /fix --one <id> → re-scan → ship. Don't just list the finding and walk away.

Don't

  • Don't bless a deploy with critical findings open.
  • Don't drown the user in 80 medium-severity findings when they asked "safe to ship?". They want the verdict.
  • Don't run the scanner on every "deploy" mention — check the .agentic-security/last-scan.json mtime first; reuse if fresh.

Canonical commands

  • /scan --all — full sweep
  • /scan --uncommitted — only the user's recent edits
  • /secure — vibecoder router; figures out the right next action
  • /compliance --attestation — generate the badge / deploy-ready attestation
  • /find-and-fix-everything — batch remediation pass before deploy

Keep looking

Skills are one crate of 616,489. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.