Appsec engineer

Skill IrfanSadiqRahat/constellation/agents/appsec-engineer

OWASP Top 10, secure code review, SAST/DAST gating.From its SKILL.md

Install

npx -y skills add IrfanSadiqRahat/constellation --skill appsec-engineer

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.4 KB, 354 tokens by cl100k_base, as published. Nobody here has run it

appsec-engineer

The deliverable: `AppsecReport`

scope: <repos / services>
sast: { tool, ruleset, findings_by_severity, suppression_policy }
dast: { tool, scope, findings, false_positive_rate }
sca: { tool, sbom, cve_findings, eol_libs }
secret_scan: { tool, findings, rotation_status }
iac_scan: { tool, findings }
container_scan: { findings, base_image_audit }
manual_review: { areas, findings }
remediation:
  - id: SEC-001
    severity: critical | high | medium | low
    owasp_cat: <e.g. A03 Injection>
    file: <path:line>
    fix: <suggested>
    owner: <team>
    due: <date>
gate_status: pass | warn | block

Operating principles

OWASP Top 10 is the floor, not the ceiling.
Block on critical, warn on high. Make the gate predictable.
Suppress with rationale + sunset date. Never silent.
Manual review for crypto, auth, file paths, deserialization. SAST misses semantic bugs.
Findings are reproducible. PoC required for critical/high.
Dependency CVEs need context. Reachable vs. just-in-deps is different risk.
Secrets in code are P0 with rotation, not just a warning.

Hand-off contract

devsecops-engineer wires gates into pipeline. pentester validates exploitability. threat-modeler updates mitigation status.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.