Security

Security audits, vulnerabilities, compliance, auth, secrets, and safe automation

skills in category: 29,231
pages available: 1,218

Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.

Open in full browser

Browse security skills

Showing 3,001–3,024 of 29,231 skills

Dependency License AuditBRead-only license audit of a dependency tree. Detects the manager(s), resolves each dependency's license from ecosystem metadata, and classifies it against a configured policy (ASF A/B/X or allowlist), surfacing incompatible, forbidden, and unknown-license dependencies. Never modifies manifests or lock files.securitypythongoVotes: 0GitHub stars: 108
Dependency AuditCRead-only dependency vulnerability audit for one repository or a local checkout. Detects the project's dependency manager(s), runs the appropriate audit tool, surfaces patchable findings grouped by severity, and proposes upgrades for maintainer review. Never modifies manifests or lock files and never opens update PRs.securitypythonrustVotes: 0GitHub stars: 108
Ci Runner AuditARead-only audit of GitHub Actions runner compatibility for one repository, a repository set, one Apache project, or the full Apache org. Finds obsolete GitHub-hosted runner labels and macOS runner/tool architecture mismatches. Produces TSV evidence; never edits workflows, opens PRs, or posts comments.securitypythonrustVotes: 0GitHub stars: 108
Audit Finding FixAFor a batch of findings from a non-security audit tool (`<audit-tool>` — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer / equivalent; full list in the body) against `<upstream>`, draft the smallest fix per finding, re-running the tool after each batch to confirm clearance. Produces a commit and a hand-back artefact; never opens a PR on autopilot or merges.securitypythongoVotes: 0GitHub stars: 108
Vote TallyAAfter the approval window closes, fetch the approval signal for an RC of `<upstream>`, classify each reply as +1 / 0 / -1 and binding or non-binding against the configured roster, produce the tally summary, and draft the `[RESULT] [VOTE]` email. Never sends mail and never applies a label without explicit RM confirmation.securitypythonrustVotes: 0GitHub stars: 108
Vote DraftADraft the `[VOTE]` email body and planning-issue comment for an RC of `<upstream>`. Reads RC metadata from the planning issue and `<project-config>/release-management-config.md`; produces a ready-to-copy `[VOTE]` subject + body and a proposed planning-issue comment. Never sends mail and never posts without explicit RM confirmation.securitypythonrustVotes: 0GitHub stars: 108
Skills DirectorySkills Directory Look up any of 103,619 scanned skills — grade, score, and every finding. Free.Check a skill
Verify RcARead-only verification of a staged RC of `<upstream>`: signatures and checksums, RAT headers, NOTICE/LICENSE, prohibited binaries, JVM artefacts, the Nexus staging repository behind them (ASF projects publishing Maven artefacts), source-tree integrity, version strings, and optionally reproducibility. Emits a PASS / PASS-WITH-WARNINGS / FAIL report; `--post-to` proposes a planning-issue comment for the RM to confirm.securitypythonrustVotes: 0GitHub stars: 108
Rc CutAEmit the paste-ready commands to tag an RC, build the source archive reproducibly, sign, checksum and stage it to the distribution backend (or, with ASF automated signing, the tag push that triggers CI). Never runs them: the RM does, with their own key and credentials.securitypythonrustVotes: 0GitHub stars: 108
PromoteAEmit the backend-shaped promotion command set for a release that has passed its vote. Reads the planning issue (must carry `vote-passed`), constructs the staging → release move for the configured distribution backend, checks PMC membership of the Release Manager, and proposes the `promoted` label. Never runs the promotion command itself and never publishes the release.securitypythonrustVotes: 0GitHub stars: 108
PrepareADraft release-preparation artefacts for `<upstream>`: the planning issue, the version-bump and changelog prep PR (with the first-release review of what the source archive ships), the post-release dev-version bump PR, and, for ASF projects, the one-time `automated-signing` setup. Every output is a draft the RM confirms; nothing is merged, filed or sent.securitypythonrustVotes: 0GitHub stars: 108
Keys SyncAAdd the Release Manager's public key to the project KEYS file: check it meets the ASF strength floor, draft the KEYS diff, and emit the `svn` (or backend) commands and keyserver reminder for the RM to run. Never holds the private key, never commits.securitypythongoVotes: 0GitHub stars: 108
Audit ReportAAssemble a per-release audit record from lifecycle artefacts (planning issue, vote thread, artefact list, promote revision, and announcement URL) and propose a PR appending it to the project's audit log. Read-only on every release surface; the only write is a PR the RM reviews and a committer merges.securitypythonrustVotes: 0GitHub stars: 108
Archive SweepAScan the release distribution area (`dist/release/<project>/` when `release_dist_backend = svnpubsub`, or the configured distribution location), identify releases past the project's retention rule, and propose the backend-shaped command set to move them to the archive area. Read-only on the distribution surface; the RM executes every archival command as themselves.securitypythongoVotes: 0GitHub stars: 108
Announce DraftADraft the `[ANNOUNCE]` email and open (never merge) the site-bump PR for a promoted release of `<upstream>`. Never sends mail.securitypythonrustVotes: 0GitHub stars: 108
StatsARead-only maintainer dashboard for the open-PR backlog of <upstream>. Surfaces a health rating, prioritised action recommendations, weekly closure velocity trends, area pressure ranking, and a triage-funnel breakdown — with the underlying area-grouped tables as a collapsible details section.securitypythongoVotes: 0GitHub stars: 108
Reviewer RoutingBGiven an open issue or PR, scores the project's configured reviewer roster across three signals — touched-area eligibility, git-history familiarity with the changed paths, and current open-review load — and proposes a primary reviewer (plus an optional backup). Read-only, propose-then-confirm: nothing is assigned, labelled, or requested without confirmation. An unresolved roster yields an explicit NO ELIGIBLE REVIEWER signal, never a fabricated handle.securitypythonrustVotes: 0GitHub stars: 108
Quick MergeAIdentify trivial, low-risk PRs in the `ready for maintainer review` queue of <upstream> that pass every quality gate and touch only supplementary areas (docs, changelog, translations, tests) — the "express lane". Surfaces and ranks candidates with per-PR diff summaries, an all-gates-green attestation, and the exact merge command. On explicit per-PR confirmation it can submit an APPROVE review, exactly as pr-management-code-review does. It never merges itself — automated merge is the deliberat...securitypythongoVotes: 0GitHub stars: 108
Pre First Pr CheckARun a newcomer-focused pre-flight checklist on a local branch before opening a PR. Checks CONTRIBUTING conventions, SPDX headers on new files, commit-message shape (including the Generated-by: trailer for AI-assisted work), and the placeholder convention — then returns a structured checklist report. Read-only; no state changes, no PR, no external writes.securitypythongoVotes: 0GitHub stars: 108
Pr TriageBSweep open PRs on the configured `<upstream>` repo, classify each against the project's quality criteria, and — on the maintainer's confirmation — act via `gh`. One disposition per PR: draft / comment / close / rebase / CI-rerun / workflow-approve / ping-stale-reviewer / request author confirmation of readiness / mark `ready for maintainer review` / promote bot-authored draft. Does **not** review code — that is `pr-management-code-review`.securitypythongoVotes: 0GitHub stars: 108
Pr Stale SweepASweep open PRs on the configured `<upstream>` repo for inactivity past a configurable threshold and propose either a conversion to draft (open but quiet) or a closure (abandoned long enough to presume the author moved on). Waits for maintainer confirmation before converting or closing.securitypythonrustVotes: 0GitHub stars: 108
MentorADraft a teaching-register comment on a GitHub issue or PR thread on the configured `<upstream>` repo, aimed at a contributor missing context the maintainer would spell out. Reads the thread, decides whether an intervention is warranted, drafts one comment per the tone guide and convention pointers, and waits for explicit confirmation before posting via `gh`. Escalates on the four hand-off triggers.securitypythongoVotes: 0GitHub stars: 108
Code ReviewBWalk a maintainer through deep, sequential code review of open PRs on the configured `<upstream>` repo. Defaults to the **"my reviews"** queue (five maintainer signals — see the Inputs table); selectors narrow to one PR, an area label, or a collaborator subset. Drafts an `approve` / `request-changes` / `comment` review per PR and posts on confirmation.securitypythongoVotes: 0GitHub stars: 108
Self ReviewARun a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and origin/<default-branch>), checks correctness, security, and project conventions, and returns a structured report. No state changes, no PR, no external writes — the report is the output.securitypythonrustVotes: 0GitHub stars: 108
Multi Agent ReviewAFan a local diff through three independent, axis-focused review passes (correctness, security, conventions), then merge the findings into a single structured report. Each pass is isolated so one axis cannot bias another. The merged report uses the same format as pairing-self-review.securitypythonrustVotes: 0GitHub stars: 108