Security preflight
Agent skills for running security scans — secret scanning (gitleaks), dependency CVE audit (npm/cargo/osv), SAST (semgrep), and a composed pre-release gate. Grounded SKILL.md runbooks for Vanta / Claude Code / any skill-aware agent. MIT.
npx -y skills add jpoindexter/security-skills --skill security-preflightAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
The composed security gate before going public or cutting a release: secret-scan + dependency-audit + sast-scan, in order, with a clear pass/triage report. The security sibling of ship-preflight — refuses to wave through unrotated secrets or shipped-runtime CVEs.
SKILL.md
3.4 KB, as published. Nobody here has run it
Security Preflight
One gate that runs the three scans in the order that matters and gives a single pass/triage verdict. The sibling of ship-preflight (which proves it works) — this proves it's safe to expose. Run it before a repo goes public and before any release tag. It is a gate, not a fix-all: it surfaces and blocks on the things that must not ship; remediation is the individual skills.
When to run
- Before a repo goes public (history becomes world-readable — the irreversible moment).
- Before any release tag (the audited artifact).
- Before a force-push or history rewrite (you're about to make the old state canonical or gone).
The gate (run in order, stop on a hard-fail)
# 1. SECRETS — hard gate. A live secret in history blocks everything.
gitleaks detect --no-banner --redact
git ls-files | grep -iE '(^|/)\.env$|\.pem$|id_rsa|credentials|api-token|\.key$' # tracked-file check
# 2. DEPENDENCY CVEs — gate on SHIPPED-runtime highs; dev-only are notes.
npm audit --omit=dev # runtime deps (the ones that ship)
cargo audit # Rust
osv-scanner scan source --recursive . # multi-ecosystem, labels (dev)
# 3. SAST — your own code; gate on injection/traversal on reachable paths.
semgrep scan --config p/security-audit --config p/secrets .
The verdict (report this shape)
Security preflight:
secrets — PASS (0 leaks, <n> commits) | FAIL (<what> — ROTATE then scrub)
deps (runtime)— PASS | FAIL (<pkg> <cve> <severity> — patch/override)
deps (dev) — <n> notes (dev-only, unreachable by shipped artifact)
sast — PASS | <n> findings (triaged: <real>/<false-positive>)
Overall: SAFE TO EXPOSE | BLOCKED on <which gate>
Pass / fail rules (don't soften them)
- Any live secret in history → BLOCKED. Rotate at the provider first (
[[secret-scan]]), then scrub. Never "we'll rotate later." - A shipped-runtime CVE at high/critical → BLOCKED until patched, overridden, or its unreachability is proven and recorded.
- Dev-only / docs-site CVEs → NOTES, not blockers (the shipped artifact via
--omit=devdoesn't include them) — but log them, with the reason they're deferred. Silent omission reads as "covered everything." - SAST injection/traversal on a user-reachable path → BLOCKED until fixed at source or sink. False positives → per-line suppress with a why (
[[sast-scan]]).
Honesty rules (the whole point of a gate)
- Report what each scan does NOT establish: gitleaks misses word-shaped secrets; audits miss zero-days; SAST misses cross-service and runtime-config flaws.
- A green gate is necessary, not sufficient — it doesn't replace a threat model.
- Never mark "safe to expose" if a scan was skipped, errored, or only partially ran. Say what you skipped, first.
Composes
[[secret-scan]] · [[dependency-audit]] · [[sast-scan]]. Mirror of ship-preflight (functional gate) — run both before a release.