What scanners does this skill support?

It supports Checkmarx One (SAST/IaC), SonarCloud (Quality/Security), Grype (Vulnerabilities), and GitHub's native security tools like Dependabot and Secret Scanning.

Does it work with private GitHub repositories?

Yes, it includes specific guidance for handling private repositories, including notes on SARIF upload limitations and SonarCloud licensing.

Can it manage Dependabot alerts?

Yes, it includes specialized gh api commands to list and inspect open Dependabot and Secret Scanning alerts.

Can I use this to dismiss false positives?

Yes, it provides a standardized protocol and GitHub API commands to dismiss alerts as false positives or 'won't fix' with the necessary rationale.

How does it help with fixing vulnerabilities?

It provides specific 'Right vs Wrong' implementation patterns for common issues like SQL injection, XSS, Path Traversal, and Insecure Deserialization.

Security Triage Engineer

Name: Security Triage Engineer
Author: bitwarden

bybitwarden

•

安全与测试

Automates the analysis, management, and remediation of security vulnerabilities across Checkmarx, SonarCloud, and GitHub Advanced Security.

The Security Triage Engineer skill streamlines the vulnerability management process by providing a standardized framework for reviewing and resolving security findings. It integrates deeply with the GitHub Advanced Security API to query alerts from Checkmarx One, SonarCloud, and Grype, offering specific remediation patterns for common vulnerabilities like SQL Injection and XSS. By following a strict false-positive protocol and documenting state changes (such as 'Proposed Not Exploitable'), this skill ensures that security debt is handled with professional rigor while maintaining high development velocity within CI/CD workflows.

主要功能

01Dependabot and Secret Scanning alert integration via GitHub API

02Strict false-positive decision tree and documentation protocols

033 GitHub stars

04Standardized triaging for Checkmarx One and SonarCloud findings

05Automated GitHub Advanced Security alert querying and management

06Vulnerability remediation patterns for SQLi, XSS, and SSRF

使用场景

01Triaging a backlog of Checkmarx SAST findings in a GitHub repository

02Implementing secure code fixes based on GitHub Advanced Security annotations

03Reviewing and dismissing false positive security hotspots in SonarCloud

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add bitwarden/ai-plugins triaging-security-findings

For use in Claude.ai and ChatGPT

主要功能

01Dependabot and Secret Scanning alert integration via GitHub API

02Strict false-positive decision tree and documentation protocols

033 GitHub stars

04Standardized triaging for Checkmarx One and SonarCloud findings

05Automated GitHub Advanced Security alert querying and management

06Vulnerability remediation patterns for SQLi, XSS, and SSRF

使用场景

01Triaging a backlog of Checkmarx SAST findings in a GitHub repository

02Implementing secure code fixes based on GitHub Advanced Security annotations

03Reviewing and dismissing false positive security hotspots in SonarCloud

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add bitwarden/ai-plugins triaging-security-findings

For use in Claude.ai and ChatGPT