code-securitylisted

Code security capability pack. Gives AI agents the judgment rules for SAST scanning (Semgrep), DAST testing (Nuclei), secret detection (Gitleaks/TruffleHog), IaC security linting (Checkov), and vulnerability triage (osv-scanner/Grype/Snyk). Research-grounded rules from tool documentation, OWASP guidelines, and real-world pipeline architecture. Use for any application security scanning, secret leak prevention, infrastructure hardening, or vulnerability prioritization task.
Sheldon-92/TAD · ★ 3 · Code & Development · score 79

Install: claude install-skill Sheldon-92/TAD

**CONSUMES**: User code/repo + scan target URL (DAST) + IaC files + optional existing scan reports **PRODUCES**: Applied security judgment rules + SARIF scan output + prioritized triage plan (P0-P3) + remediation actions + CI/CD gate configs # Code Security Capability Pack  **Version**: 0.1.0 **Compatibility**: Claude Code (Phase 1); Codex / Cursor / Gemini in Phase 3 **License**: Apache 2.0 --- ## What This Pack Does AI agents set up security scanning by installing one tool and running it with default settings. They dump raw scanner output to the developer and call it done. They run SAST without DAST, missing runtime vulnerabilities entirely. They treat every CRITICAL CVSS as equally urgent, ignoring reachability and exploit probability. They detect secrets but clean up code before rotating the credential — leaving the attacker with a working key. This pack embeds the judgment rules that application security engineers apply automatically — rules from Semgrep, Nuclei, Gitleaks, TruffleHog, Checkov, and vulnerability triage practices grounded in OWASP and real-world pipeline architecture. **Pack = security judgment. Your workflow