fortify
- 9 skills
- 0 followers
- 19 hours ago last updated
- ▌ Fcli Common · fortify bundleGeneric reference for the Fortify CLI (fcli). Install, upgrade, authenticate, fcli environment variables, output formats, SpEL query syntax, variable chaining and custom action framework.
- ▌ Fortify Fod · fortify bundlePerform tasks against Fortify on Demand (FoD): query applications/releases; query & triage existing security issues in FoD; start & monitor full SAST/DAST/SCA/open source scans of the codebase; create releases; import FPR/SARIF/CycloneDX artifacts; policy and portfolio analysis. NOT for lightweight AI review of local code changes/diffs (use fortify-change-review).
- ▌ Fortify Ssc · fortify bundlePerform tasks against Fortify SSC (Software Security Center): query applications/application versions; query & triage existing security issues in SSC; start & monitor full ScanCentral SAST/DAST scans or upload FPR artifacts; create app versions; policy and portfolio analysis. NOT for lightweight AI review of local code changes/diffs (use fortify-change-review).
- ▌ Fortify Remediate · fortify bundleRemediate SAST (static) and DAST (dynamic) security vulnerabilities ALREADY detected by Fortify in FoD or SSC — fix specific issues, categories, or reduce issue counts, including applying SAST Aviator fixes. For SCA / open source dependency findings (vulnerable third-party components, CVEs), use fortify-dependency-upgrade instead. NOT for discovering or reviewing new issues (use fortify-change-review for a local code-change review, or fortify-fod / fortify-ssc to scan and triage).
- ▌ Fortify Create App · fortify bundleCreate new Fortify application(s) in Fortify on Demand (FoD) or Application Security Center (SSC).
- ▌ Fortify Change Review · fortify bundleLightweight, AI-powered security review of code CHANGES (a diff, PR, or in-session edits) using the agent's own analysis — no Fortify scan engine or platform needed. Use when the user asks to "run a Fortify security review" / "Fortify change review", or when adding/modifying code touching authentication, authorization, input handling, output encoding, data access, file operations, outbound HTTP, deserialization, cryptography, transport security, XML parsing, logging, LLM/agent logic, or IaC (AWS, Azure, GCP, Terraform, Kubernetes, Helm). NOT for full SAST/DAST/SCA scans or triaging issues already found by FoD/SSC (use fortify-fod / fortify-ssc).
- ▌ Fortify Cicd Integration · fortify bundleIntegrate Fortify application security (SAST, SCA, DAST) with GitHub Actions, GitLab Pipelines, Azure DevOps, Jenkins & other CICD/DevSecOps pipelines.
- ▌ Fortify Dependency Upgrade · fortify bundlePerform dependency upgrade impact assessment, code fixes, and migration work. Use to remediate Fortify SCA / open source / software composition analysis findings — vulnerable third-party dependencies, CVEs/GHSAs, components flagged by FoD or SSC — by upgrading to a safe version and fixing any resulting breakage. Also use when the user asks what will break after a version change, hits compile/test failures, needs code fixed for compatibility, needs help resolving dependency conflicts, or fixing breaking changes from direct or transitive dependency updates, including framework version changes that affect starters, plugins, annotations, configs, or imports. (For SAST/DAST code findings, use fortify-remediate instead.) Covers npm/yarn, Maven/Gradle, pip/poetry, Go modules, Cargo, Bundler, Composer, NuGet, C++ (CMake/Conan/vcpkg), iOS/macOS (CocoaPods/SPM/Carthage), and Scala (sbt/Mill).
- ▌ Fortify Exploitability Analysis · fortify bundleTriage whether a known CVE/GHSA vulnerability is actually exploitable in this project. Use when the user wants a reachability verdict on a specific advisory — is the project really affected, or is the advisory noise? Analysis only; for fixes, hand off to fortify-dependency-upgrade.