# Security Vulnerability Report

> Scan GitHub repositories for security vulnerabilities including Dependabot alerts, code scanning results, and secret scanning findings. Use when auditing repository security, preparing compliance reports, or triaging vulnerability alerts. Use when this capability is needed.

- Skill: `tomevault-io/security-vulnerability-report` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/security-vulnerability-report`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-vulnerability-report/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/security-vulnerability-report

---


# Security Vulnerability Report

Query GitHub for Dependabot alerts, code scanning results, and secret scanning findings across repositories to produce a prioritized vulnerability report.

## Instructions

### Phase 1: Dependabot Alerts (GitHub Agent)
1. **Fetch Dependabot alerts** across all configured repositories
   - Alert severity, affected package, CVE identifier, fix availability

### Phase 2: Code Scanning Results (GitHub Agent)
1. **Fetch code scanning alerts** - rule ID, severity, file location

### Phase 3: Secret Scanning (GitHub Agent)
1. **Check for secret scanning alerts** - secret type, revocation status

### Phase 4: Compile Report
1. **Aggregate across repositories** with cross-repo dedup
2. **Prioritize by** severity, exploitability, fix availability
3. **Calculate risk score** per repository

## Output Format

\`\`\`markdown
## Security Vulnerability Report

### Executive Summary
| Severity | Open | Fixed (30d) | Dismissed |
|----------|------|-------------|-----------|
| Critical | 2 | 5 | 0 |
| High | 7 | 12 | 1 |

### Critical Vulnerabilities (Immediate Action Required)
#### 1. CVE-2026-1234 - Remote Code Execution in lodash
- **Repository**: ai-platform-engineering/ui
- **CVSS**: 9.8 | **Fix**: Upgrade to lodash@4.17.22
\`\`\`

## Examples

- "Check all repositories for security vulnerabilities"
- "Show me critical Dependabot alerts"
- "Are there any secret scanning findings?"
- "Generate a security report for the ai-platform-engineering repo"

## Guidelines

- Always sort by severity (critical first), then by fix availability
- Flag any vulnerabilities with known exploits in the wild as top priority
- Deduplicate shared dependencies across repos
- Never display actual secret values in the report - only the type and location
- Reference project codeguard rules: no hardcoded credentials, no banned crypto algorithms

---
> Source: [cnoe-io/ai-platform-engineering](https://github.com/cnoe-io/ai-platform-engineering) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-07-04 -->