Fortify

Skill yuelenghan/orbit/skills/fortify

An open-source arsenal of reusable skills for AI agents — repo understanding, code review, delivery workflows, security pentests, and plug-and-play integrations with Jira, GitHub, GitLab, Jenkins & more. Drop into Claude Code, Codex, or any skill-aware host.

Install

npx -y skills add yuelenghan/orbit --skill fortify

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when the user needs Fortify SSC issue results, project lists grouped by severity, or read-only Fortify passthrough commands.

SKILL.md

3.3 KB, as published. Nobody here has run it

Fortify Skill

Use this skill to query Fortify SSC issues, list matching projects by severity, and run packaged ssc / fcli passthrough commands through the local launcher.

Runtime and execution

Run the packaged launcher from the extracted skill root:

macOS/Linux: bash "<skill-root>/bin/fortify"
Windows: <skill-root>\bin\fortify.cmd

Do not call app/dist/cli.js directly from the skill layer. Use the packaged launcher so the launcher-managed Node runtime and launcher-managed Java runtime stay in the execution path. For query and passthrough commands, use the packaged launcher so it can also resolve the official cached fcli.jar. Do not tell the user to install or invoke Node, Java, Python, or fcli separately for the packaged launcher flow. On darwin-arm64, darwin-x64, and win32-x64, the launcher first reuses a compatible system Node and otherwise bootstraps the packaged Node version into a local cache. On darwin-arm64, darwin-x64, and win32-x64, the launcher also reuses a compatible system Java first, falls back to a bundled JRE only for old packages, and otherwise bootstraps the configured Java runtime into a local cache. On darwin-arm64, darwin-x64, and win32-x64, query and passthrough commands bootstrap the official fcli.jar into the local cache when the jar is not already available.

Scope and boundaries

Fortify SSC reads and read-only passthrough only through the packaged launcher.
Do not invoke raw ssc, raw fcli, or direct HTTP calls from the skill layer.
Keep config recovery and passthrough guard rails in references/usage.md.

Legacy top-level query compatibility is preserved through the packaged launcher, and the explicit query issues form is supported. Use query projects --severity only for cross-project severity summaries. For SSC inventory reads like "获取 Fortify 上的所有项目", "列出 Fortify 的全部项目", or "列出某个项目的所有版本", prefer the read-only passthrough path:

bash "<skill-root>/bin/fortify" fcli -- ssc app list -o json
bash "<skill-root>/bin/fortify" fcli -- ssc appversion list -q 'application.name=="sample-service"' --include active,inactive -o json

On Windows, use <skill-root>\bin\fortify.cmd with the same arguments.

Use references/usage.md for config recovery, stable error handling, passthrough guard rails, and severity fallback behavior.

Capability Domain

Domain:

security_scan

Provides:

security_scan.config.get
security_scan.config.set
security_scan.project.list
security_scan.findings.list
security_scan.passthrough.read
provider-specific workflow helpers

Config check:

fortify config get

Config check

Run fortify config get when configuration state is unknown or before the first provider-scoped task in a new session.

Supporting files

Read references/commands.md for packaged command forms.
Read references/usage.md for config recovery, guard rails, and error handling.
Read examples/common-workflows.md for end-to-end examples.