Stats
Actions
Tags
From agentic-security
Runs security scans before deployment, checks freshness, and provides deploy-ability verdict with triage flows.
How this skill is triggered — by the user, by Claude, or both
Slash command
/agentic-security:security-scan-on-deployThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Activates when the user is about to push code to production, asks if their
Activates when the user is about to push code to production, asks if their
project is safe to ship, or mentions any of the destructive-prone deploy
commands (vercel --prod, fly deploy, wrangler publish, npm publish,
gh pr merge --auto).
Check for fresh scan state. Read
.agentic-security/last-scan.json mtime. If it's older than
24 hours OR doesn't exist, run a fresh scan first:
/scan --all for the full surface, or /scan --uncommitted if
the user only edited a few files.
Render the verdict, not the wall of findings. The user is making a deploy decision, not auditing. Lead with:
/compliance --attestation to
generate the badge./fix --all --critical for batch remediation, or recommend wiring the
CI bench gate so blocking is automatic next time./triage --show --all before deploy, mention the deploy is
still possible but flag the risk.Surface the production-aware filters. If /scan --exposed-only
has been configured (WAF / auth-middleware / network-policy
ingest), use it. A finding the WAF already blocks shouldn't
block the deploy.
Offer one-finding triage flow. If there's one blocker,
suggest:
/triage --explain <id> → /fix --one <id> → re-scan → ship.
Don't just list the finding and walk away.
.agentic-security/last-scan.json mtime first; reuse if fresh./scan --all — full sweep/scan --uncommitted — only the user's recent edits/secure — vibecoder router; figures out the right next action/compliance --attestation — generate the badge / deploy-ready attestation/find-and-fix-everything — batch remediation pass before deploynpx claudepluginhub clear-capabilities/agentic-security --plugin agentic-securityRuns deep security scans, vulnerability checks, and IaC validation using sync-ctl for pre-deployment audits and compliance verdicts.
Run repository security scans for vulnerabilities, dependency risk, secrets, and release gates with composable binary and prompt-surface testing primitives.
Runs a lightweight mechanical security scan for fast triage. Invoked via /Harness Security Scan or as part of codebase-health-analyst sweep.