Agent skill
secure
Find and fix security issues before they become incidents. Vulnerability scanning, SBOM generation, supply chain security, and secure authentication workflows.
Install this agent skill to your Project
npx add-skill https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/secure/skills/secure
SKILL.md
Secure
When to Use This Skill
This section covers the tools and practices for discovering and remediating security issues in code, dependencies, containers, and supply chains.
Implementation
- Start with GitHub Apps: Replace PATs with secure, auditable authentication
- Add vulnerability scanning: Catch known CVEs before they deploy
- Generate SBOMs: Document your supply chain for compliance
- Run Scorecard: Measure and improve security posture
- Layer on enforcement: Make findings actionable with Enforce patterns
Comparison
Understanding the distinction:
-
Secure (this section): Find and fix security issues
- Vulnerability scanners that identify CVEs
- SBOM generators that document dependencies
- Security tools that discover weaknesses
- GitHub Apps that provide secure authentication
-
Enforce (see Enforce): Make security mandatory through automation
- Branch protection that requires reviews
- Pre-commit hooks that block violations
- Status checks that prevent merges
- Policy-as-code that enforces runtime compliance
Litmus test: Can this be bypassed?
- If no → It's a Secure tool (finding/fixing)
- If yes → It belongs in Enforce (making mandatory)
Examples
See examples.md for code examples.
Related Patterns
- Enforce
- Build
- Patterns
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
adaptive-enforcement-lab/claude-skills
github-token-permissions-overview
Understanding GITHUB_TOKEN scope, default permissions, and implementing least-privilege principle for GitHub Actions workflows.
adaptive-enforcement-lab/claude-skills
complete-workflow-examples
Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
adaptive-enforcement-lab/claude-skills
ephemeral-runner-patterns
Disposable runner patterns for GitHub Actions. Container-based, VM-based, and ARC deployment strategies with complete state isolation between jobs.
adaptive-enforcement-lab/claude-skills
action-pinning-overview
Why pinning GitHub Actions to SHA-256 commits matters for supply chain security. Attack vectors from unpinned actions and comparison of tag vs SHA pinning.
adaptive-enforcement-lab/claude-skills
github-actions-security-patterns-hub
Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.
adaptive-enforcement-lab/claude-skills
security-scanning-workflows
Comprehensive security scanning examples with SAST (CodeQL), dependency scanning, container vulnerability detection (Trivy), and SARIF upload to GitHub Security tab.
Didn't find tool you were looking for?