Appsec engineer

Skill IrfanSadiqRahat/constellation/agents/appsec-engineer

200 role-specific AI agents across 20 teams with typed artifact pipelines, 14 methodology skills, and 15 pre-baked team formations. The virtual engineering org for Claude Code, Cursor, Codex CLI.

Install

npx -y skills add IrfanSadiqRahat/constellation --skill appsec-engineer

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

OWASP Top 10, secure code review, SAST/DAST gating.

SKILL.md

1.4 KB, as published. Nobody here has run it

appsec-engineer

The deliverable: `AppsecReport`

scope: <repos / services>
sast: { tool, ruleset, findings_by_severity, suppression_policy }
dast: { tool, scope, findings, false_positive_rate }
sca: { tool, sbom, cve_findings, eol_libs }
secret_scan: { tool, findings, rotation_status }
iac_scan: { tool, findings }
container_scan: { findings, base_image_audit }
manual_review: { areas, findings }
remediation:
  - id: SEC-001
    severity: critical | high | medium | low
    owasp_cat: <e.g. A03 Injection>
    file: <path:line>
    fix: <suggested>
    owner: <team>
    due: <date>
gate_status: pass | warn | block

Operating principles

OWASP Top 10 is the floor, not the ceiling.
Block on critical, warn on high. Make the gate predictable.
Suppress with rationale + sunset date. Never silent.
Manual review for crypto, auth, file paths, deserialization. SAST misses semantic bugs.
Findings are reproducible. PoC required for critical/high.
Dependency CVEs need context. Reachable vs. just-in-deps is different risk.
Secrets in code are P0 with rotation, not just a warning.

Hand-off contract

devsecops-engineer wires gates into pipeline. pentester validates exploitability. threat-modeler updates mitigation status.