DefectDojo
- 14 skills
- 0 followers
- 6 hours ago last updated
- ▌ Write Tui · defectdojo bundleUse when writing or modifying the kimi-code terminal UI in apps/kimi-code/src/tui — components, dialogs/selectors, slash commands, themes, streaming render, or the KimiTUI controllers. Covers the architecture, where new features go, test placement, the theme system mechanics, and the dialog interaction/visual spec (DESIGN.md).
- ▌ Pre Changelog · defectdojoUse before merging a kimi-code release PR to preview the user-facing CLI changelog in Chinese. Reads the changelog that changesets pre-generated in the release PR, then reuses sync-changelog's strip / classify / translate logic to render a Chinese preview. Writes no files.
- ▌ Agent Core Dev · defectdojo bundleUse when developing in packages/agent-core-v2 (the DI × Scope agent engine) — adding or modifying a domain Service, choosing a LifecycleScope, wiring DI dependencies, splitting a domain across scopes, owning or migrating a config section, gating behavior behind an experimental flag, raising coded errors, working on the permission system, writing DI/Scope tests, porting business logic from agent-core (v1) to v2, triaging a main-branch commit against v2, or exposing a v2 domain over server-v2 while keeping the /api/v1 wire contract compatible with released clients. Self-contained guide organized by development stage (orient → design → implement → test → verify) plus align workflows for v1→v2 migration, main-branch commit triage, and server-v2 wire exposure; each file carries the rules, examples, and red lines for its step.
- ▌ Gen Changesets · defectdojoUse when generating changesets in the kimi-code repository, including package bump selection, internal package and CLI bundle handling, bump levels, major confirmation, and English changelog wording.
- ▌ Sync Changelog · defectdojoUse after a release succeeds, when maintainers need to sync apps/kimi-code/CHANGELOG.md into docs/en/release-notes/changelog.md and docs/zh/release-notes/changelog.md, then open a PR on a dedicated branch.
- ▌ Kimi Datasource · defectdojo bundleUniversal data-source assistant. Use this skill when the user wants external structured data such as stocks, financial reports, technical indicators, A-share/HK/US markets, global macroeconomics, Chinese enterprise registry information, arXiv papers, Google Scholar results, Chinese laws/regulations and judicial cases, Wind financial data (intraday/minute quotes, funds, bonds), IMF macro datasets (FX rates, CPI, GDP forecasts), Gildata smart screening, US SEC filings (10-K/10-Q, Form 4, 13F), or S&P Capital IQ fundamentals (top holders, consensus estimates, valuation ratios). This plugin exposes tools via MCP server `plugin-kimi-datasource_data`; call them in the flow `mcp__plugin-kimi-datasource_data__get_data_source_desc` → `mcp__plugin-kimi-datasource_data__call_data_source_tool`.
- ▌ Import Scans · defectdojo bundleUpload scanner output or an SBOM into DefectDojo Pro. Use when the user has results from a security scanner and wants them in DefectDojo, or says import this scan, upload these results, push the Semgrep or Trivy or ZAP or Snyk or Nuclei or Burp output to Dojo, ingest this SBOM or CycloneDX or SPDX file, or reimport the latest scan. Trigger even if the word DefectDojo never appears, for example "get these scan results into our vulnerability tracker" or "load this JSON from the scanner". Handles product and engagement creation, import versus reimport, and background processing.
- ▌ Wire CI Import · defectdojo bundleAdd DefectDojo scan upload to a repository's CI pipeline. Use when the user wants scan results pushed to DefectDojo automatically on every build or pull request, asks to add DefectDojo to GitHub Actions or GitLab CI or Jenkins, wants to automate scan upload, or wants their pipeline wired into their vulnerability tracker. Trigger on phrasings like "send our scans to Dojo from CI", "automate this upload", "add this to our pipeline", or "I do not want to run this by hand every time". Edits pipeline files in the repository and sets up the API token as a CI secret.
- ▌ Findings Query · defectdojo bundleAnswer questions about DefectDojo security findings, products, engagements, tests, and risk posture, and produce a security brief. Use for questions like how many critical findings are open, what is our riskiest application, show me open SQL injection findings, what changed this week, which product has the worst backlog, what should we fix first, give me a security summary for standup, or top CWEs. Trigger even if the word DefectDojo never appears whenever the user asks about vulnerabilities, findings, scan results, security posture, or a security backlog and DefectDojo tools are available. Read-only, never changes finding state.
- ▌ Security Report · defectdojo bundleBuild a security report from DefectDojo Pro data for an executive, board, engineering leadership, or audit audience. Use when the user asks for a security report, board deck material, quarterly or monthly security summary, exec summary of vulnerability posture, remediation or MTTR trends, program health, scanner coverage, or a PDF for the CISO. Trigger even if the word DefectDojo never appears, on phrasings like "I need numbers for the board", "summarize where our security program stands", "what do I tell leadership about our backlog", or "put together the quarterly vuln report".
- ▌ Triage Findings · defectdojo bundleChange the state of DefectDojo findings and annotate them, including close, reopen, verify, mark false positive, mark out of scope, risk accept, add notes, add or remove tags, and merge duplicates. Use when the user wants to triage, dispose of, clean up, or work through findings or a security backlog. Trigger even if the word DefectDojo never appears, on phrasings like "this one is not real", "we fixed that ages ago", "accept the risk on these", "mark these as false positives", "close finding 4711", "tag everything from that scanner", or "help me clear this backlog". Always proposes changes and waits for explicit confirmation before writing.
- ▌ Connection Doctor · defectdojo bundleDiagnose and repair the connection between Claude Code and DefectDojo Pro. Use when DefectDojo tools are missing or failing, when setting up or configuring DefectDojo for the first time, when a token is rejected or expired, when the user asks whether DefectDojo is connected or working, or when any other DefectDojo skill stops with a connection, authentication, permission, or edition error. Trigger even if the word DefectDojo never appears, for example "my security findings tools disappeared", "why do I get 401 from the vuln tracker", "the scanner database says forbidden", or a pasted "Token authentication failed" error.
- ▌ Defectdojo Dev · defectdojo bundleDevelop, test, and validate DefectDojo changes end to end against a local Docker stack — bring the app up on localhost:8080, reproduce a bug on the target branch before fixing it, write behavioral unit tests that fail without the fix, drive the UI with the Playwright MCP, and fetch an API token to exercise the REST API. The same review lenses (scalability, performance, memory, DB resourcing, query design, security, DRF serializer exposure) let it double as an inbound PR reviewer, with a dedicated checklist for infra/Helm/deployment PRs. Use when developing or testing a change, reproducing or fixing a bug, writing a regression test, validating a fix, or reviewing any DefectDojo PR/branch (app, API, or Helm chart).
- ▌ Defectdojo Parser · defectdojo bundleAuthor and review DefectDojo parsers (scan-report importers under dojo/tools/<name>/parser.py) to the project's real conventions — the factory contract, required Finding fields, deduplication registration in settings.dist.py, defusedxml/utf-8/Endpoint.from_uri rules, the 0/1/many unit-test set with attribute-level assertions, sample-file sanitization and size discipline, and the CI meta-test (unittests/test_parsers.py) that enforces the directory/docs layout. Use when writing a new parser, adding a scan type, reviewing a parser PR, or debugging a failing parser/test_parsers test.