agentsclimarketplace
Sign in

Reviewing security posture

Skill pvnarp/harness-agentic-skills/skills/cross-product/reviewing-security-posture

Comprehensive security posture assessment across Traceable (API security), Harness SAST and SCA (formerly Qwiet AI / ShiftLeft) and Harness CI/CD, STO, compliance. Produces a consolidated CISO-level briefing with metrics from all three products. Use when user asks for "security posture", "full security review", "CISO briefing", "how secure are we", "security assessment", "board presentation on security", or "comprehensive security report".From its SKILL.md

Install
npx -y skills add pvnarp/harness-agentic-skills --skill reviewing-security-posture

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

11.8 KB, as published. Nobody here has run it

Security Posture Review

What this skill uses

Harness MCP tools: harness:harness_get, harness:harness_list, harness:harness_status Resource types: audit_event, security_issue, sei_dora_metric Traceable MCP tools: traceable-ai:get_query_time_range CLI: sl auth, sl check-analysis REST API: https://app.shiftleft.io/api/v4

Comprehensive security posture assessment that gathers data from Traceable (API security), Harness SAST and SCA (code security, formerly Qwiet AI / ShiftLeft), and Harness (CI/CD and compliance) to produce a consolidated executive-level security briefing. This is a read-only assessment -- it does not modify any configurations or trigger deployments.

Instructions

Prerequisites

Before starting, collect the following from the user:

  • Harness org and project identifiers
  • Harness SAST and SCA org ID (formerly Qwiet) ($SHIFTLEFT_ORG_ID or user input)
  • Scope of review: All services or specific services?
  • Audience: Executive/CISO briefing or technical deep-dive?
  • Time range: Last 7 days, 30 days, or custom?

If the user asks for a quick overview, you can skip some sub-assessments. If they ask for a full review or board presentation, run all phases.

Phase 1: Traceable API Security Assessment

Follow the Traceable MCP tool calling sequence for each sub-assessment. Initialize the time range once with traceable-ai:get_query_time_range and reuse it across all queries in this phase.

Run each sub-assessment below. For each, follow the named skill instructions.

  • /inventorying-apis: Total API count, service distribution, external vs. internal split, new APIs in review period
  • /discovering-shadow-apis: Undocumented APIs, zombie endpoints, risk scores, worst services
  • /analyzing-auth-coverage: Auth coverage percentage, unauthenticated APIs, auth methods, weak patterns
  • /analyzing-pii-exposure: PII-transmitting APIs, data types (SSN, CC, email), compliance mapping (GDPR/HIPAA/PCI), PII in URL params
  • /mapping-attack-surface: External API count, exposure score, unauthenticated entry points, risk by domain
  • /prioritizing-findings: Top vulns by risk score, categories, trend direction, MTTR for resolved findings

Phase 2: Harness SAST and SCA Code Security Assessment

List all apps: GET https://app.shiftleft.io/api/v4/orgs/$SHIFTLEFT_ORG_ID/apps. For each app, get findings: GET .../apps/<appID>/findings. Aggregate: total findings by severity, top vulnerability categories, worst applications, new vs. resolved trend, and vulnerable dependencies (SCA). Check policy compliance per app with sl check-analysis --v2 --app "<app-name>".

Phase 3: Harness Platform Assessment

  • /reporting-security-posture: Use harness:harness_list (resource_type: "security_issue") for STO vulnerability counts by severity, SBOM coverage, OPA compliance results, and active exemptions
  • /reporting-dora-metrics: Use harness:harness_get (resource_type: "sei_dora_metric") for deployment frequency, lead time, change failure rate, and MTTR
  • /reporting-audit-events: Use harness:harness_list (resource_type: "audit_event") for recent audit events, compliance evidence (SOC2/GDPR/HIPAA), unusual activity patterns
  • Project health: Use harness:harness_status for pipeline success rates, active services, delegate health

Phase 4: Consolidated CISO Briefing

Follow the /briefing-ciso skill instructions to frame the output. Synthesize all data from Phases 1-3 into an executive-level report.

## Security Posture Review

**Date:** <date>
**Scope:** <org/project or specific services>
**Review Period:** <time range>
**Prepared For:** <audience>

---

### Executive Summary

<2-3 sentence overview of overall security posture. State whether posture
is STRONG, ADEQUATE, or NEEDS ATTENTION. Highlight the single most
important finding.>

---

### API Security Posture (Traceable)

| Metric | Value | Status |
|--------|-------|--------|
| Total APIs | X | -- |
| External APIs | X | -- |
| Shadow/Undocumented APIs | X | RED/YELLOW/GREEN |
| Auth Coverage | X% | RED/YELLOW/GREEN |
| APIs Exposing PII | X | RED/YELLOW/GREEN |
| Attack Surface Score | X/100 | RED/YELLOW/GREEN |
| Open Vulnerabilities | X critical, Y high | RED/YELLOW/GREEN |

**Top API Risks:**
1. <highest risk finding with business context>
2. <second highest>
3. <third highest>

---

### Code Security Posture (Harness SAST and SCA)

| Metric | Value | Status |
|--------|-------|--------|
| Applications Scanned | X | -- |
| Critical Findings | X | RED/YELLOW/GREEN |
| High Findings | X | RED/YELLOW/GREEN |
| Policy Violations | X apps | RED/YELLOW/GREEN |
| Vulnerable Dependencies | X | RED/YELLOW/GREEN |

**Top Code Risks:**
1. <highest risk finding>
2. <second highest>
3. <third highest>

---

### Delivery & Compliance Posture (Harness)

| Metric | Value | Benchmark |
|--------|-------|-----------|
| Deployment Frequency | X/week | Elite: multiple/day |
| Lead Time | X hours | Elite: <1 hour |
| Change Failure Rate | X% | Elite: <15% |
| MTTR | X hours | Elite: <1 hour |
| STO Vulnerabilities | X critical | -- |
| SBOM Coverage | X% | Target: 100% |
| Active Exemptions | X | -- |

**Compliance Status:**
- SOC2: <status>
- GDPR: <status>
- HIPAA: <status>

---

### Risk Heat Map

| Domain | API Security | Code Security | Delivery | Overall |
|--------|-------------|---------------|----------|---------|
| <svc1> | RED/YELLOW/GREEN | RED/YELLOW/GREEN | RED/YELLOW/GREEN | RED/YELLOW/GREEN |
| <svc2> | RED/YELLOW/GREEN | RED/YELLOW/GREEN | RED/YELLOW/GREEN | RED/YELLOW/GREEN |

---

### Recommendations (Priority Order)

1. **[CRITICAL]** <action> -- <business justification>
2. **[HIGH]** <action> -- <business justification>
3. **[MEDIUM]** <action> -- <business justification>
4. **[LOW]** <action> -- <business justification>

---

### Trend (vs. Previous Review)

- API risk score: <improved/degraded/stable>
- Code findings: <X fewer/more than last period>
- MTTR: <improved/degraded/stable>
- Overall trajectory: <improving/stable/declining>

Adjust the report depth based on the audience:

  • CISO/Board: Focus on business impact, risk trends, and strategic recommendations. Minimize technical jargon.
  • Security Team: Include full technical details, specific CVEs, and remediation steps.
  • Engineering Team: Emphasize actionable fixes, affected services, and DORA metrics.

Examples

Example 1: Executive security review

User: "Give me a full security posture review for the board meeting"

What the AI does:

  1. Runs all Traceable assessments: API inventory (342 APIs), shadow APIs (12 found), auth coverage (94%), PII exposure (8 APIs), attack surface scoring, and findings prioritization
  2. Queries Harness SAST and SCA for all apps: finds 15 applications, 3 critical findings, 12 high, 47 medium
  3. Pulls Harness data: DORA metrics (weekly deploys, 4hr lead time, 8% CFR, 2hr MTTR), STO vulns, SBOM coverage at 78%
  4. Generates a board-ready briefing with status "ADEQUATE" and three priority recommendations

Example 2: Quick posture check

User: "How secure are we right now?"

What the AI does:

  1. Runs the highest-signal assessments only: API risk score, critical code findings, change failure rate
  2. Provides a quick summary: "Your API risk score is 67/100 (moderate), you have 3 unresolved critical SAST findings, and your change failure rate is 8% (good). Top concern: 12 shadow APIs detected last week."
  3. Offers to run the full review for more detail

Example 3: Service-specific deep dive

User: "What's the security posture of the payments service?"

What the AI does:

  1. Filters all Traceable queries to the payments service
  2. Checks Harness SAST and SCA findings for the payments application specifically
  3. Pulls Harness pipeline and STO data for payments pipelines
  4. Generates a focused report: 23 APIs, 2 unauthenticated, 1 critical code finding (deserialization), 99.5% deployment success rate
  5. Recommends: fix the deserialization issue, add auth to the 2 endpoints, investigate the 1 shadow API

Related skills

Composes with (skills commonly invoked together):

Follow-ups (skills commonly chained after this one):

Performance Notes

  • Phase 1 (Traceable) involves 6 sub-assessments with multiple GraphQL queries each. This is the most data-intensive phase. Allow 2-5 minutes for completion.
  • Phase 2 (Harness SAST and SCA) scales with the number of applications. For organizations with many apps, consider sampling the most critical ones rather than scanning all.
  • Phase 3 (Harness) is typically the fastest phase since it uses direct MCP tool calls.
  • For a quick posture check, run only the highest-signal assessments from each phase: assessing-risk, critical findings count, and DORA metrics.
  • Cache the time range from traceable-ai:get_query_time_range and reuse it across all Traceable queries to ensure consistent data.
  • The consolidated report should be generated even if one phase partially fails. Note which data is missing and why.

Troubleshooting

Traceable returns empty results for some assessments

  • Verify the Traceable agent is deployed and sending data
  • Check the time range -- a narrow window may miss intermittent APIs
  • Some assessments require traffic to the APIs; idle services may show no data
  • Confirm the environment filter matches the target environment

Harness SAST and SCA API returns 401 or 403

  • Verify $SHIFTLEFT_ACCESS_TOKEN is set and not expired
  • Check that the org ID is correct
  • The token may need refresh: run sl auth to re-authenticate

Harness DORA metrics are empty

  • DORA metrics require pipeline execution history
  • Verify the project has had deployments in the review period
  • Check that the deployment pipelines are tagged correctly for DORA tracking

Report data is inconsistent across products

  • Different products may use different time ranges by default. Normalize to the same review period.
  • Service names may differ between Traceable, Harness SAST and SCA, and Harness CD. Map them manually if needed.
  • Some metrics are point-in-time while others are aggregated. Note the measurement basis in the report.

Assessment takes too long

  • For large organizations, scope the review to specific services or projects
  • Skip Phase 1.4 (PII) and Phase 1.5 (Attack Surface) for a faster review
  • Use harness:harness_status alone for a quick Harness health check instead of full Phase 3

Keep looking

Skills are one crate of 627,801. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.