# Security Vulnerability Report

> Scan GitHub repositories for security vulnerabilities including Dependabot alerts, code scanning results, and secret scanning findings. Use when auditing repository security, preparing compliance reports, or triaging vulnerability alerts.

- Skill: `caipe-io/security-vulnerability-report-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add caipe-io/security-vulnerability-report-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/caipe-io/security-vulnerability-report-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: caipe-io (https://skillmd.com/u/caipe-io)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/caipe-io/security-vulnerability-report-2

---


# Security Vulnerability Report

Query GitHub for Dependabot alerts, code scanning results, and secret scanning findings across repositories to produce a prioritized vulnerability report.

## Instructions

### Phase 1: Dependabot Alerts (GitHub Agent)
1. **Fetch Dependabot alerts** across all configured repositories
   - Alert severity, affected package, CVE identifier, fix availability

### Phase 2: Code Scanning Results (GitHub Agent)
1. **Fetch code scanning alerts** - rule ID, severity, file location

### Phase 3: Secret Scanning (GitHub Agent)
1. **Check for secret scanning alerts** - secret type, revocation status

### Phase 4: Compile Report
1. **Aggregate across repositories** with cross-repo dedup
2. **Prioritize by** severity, exploitability, fix availability
3. **Calculate risk score** per repository

## Output Format

\`\`\`markdown
## Security Vulnerability Report

### Executive Summary
| Severity | Open | Fixed (30d) | Dismissed |
|----------|------|-------------|-----------|
| Critical | 2 | 5 | 0 |
| High | 7 | 12 | 1 |

### Critical Vulnerabilities (Immediate Action Required)
#### 1. CVE-2026-1234 - Remote Code Execution in lodash
- **Repository**: ai-platform-engineering/ui
- **CVSS**: 9.8 | **Fix**: Upgrade to lodash@4.17.22
\`\`\`

## Examples

- "Check all repositories for security vulnerabilities"
- "Show me critical Dependabot alerts"
- "Are there any secret scanning findings?"
- "Generate a security report for the ai-platform-engineering repo"

## Guidelines

- Always sort by severity (critical first), then by fix availability
- Flag any vulnerabilities with known exploits in the wild as top priority
- Deduplicate shared dependencies across repos
- Never display actual secret values in the report - only the type and location
- Reference project codeguard rules: no hardcoded credentials, no banned crypto algorithms