# Security Scan

> >

- **Type:** Skill
- **Install:** `agentstack add skill-cloudbees-oss-devops-agent-kit-security-scan`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [cloudbees-oss](https://agentstack.voostack.com/s/cloudbees-oss)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [cloudbees-oss](https://github.com/cloudbees-oss)
- **Source:** https://github.com/cloudbees-oss/devops-agent-kit/tree/main/.claude/skills/security-scan

## Install

```sh
agentstack add skill-cloudbees-oss-devops-agent-kit-security-scan
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

## Security Scan: $ARGUMENTS

### If "all" or no argument:

1. `security_issues_all_get` — get all open security issues across the org
2. `components_list` — get all components for cross-referencing
3. For each component with findings:
   a. `branches_list` — find the default branch
   b. `security_findings_summary_get` — severity breakdown
   c. `security_issues_open_get` — detailed finding list
   d. `runs_list(limit=3)` — check if recent scans ran successfully

4. Get org-level security reports:
   a. `organizations_suborg_report(s1)` — components with scanner coverage
   b. `organizations_suborg_report(s2)` — workflows with scanner coverage
   c. `organizations_suborg_report(s6)` — scan types in automations
   d. `organizations_suborg_report(s8)` — SLA status
   NOTE: s4 and s5 may return "No Data Found" at the org level.
   Use component-level tools instead if this happens.

5. Present a security dashboard:

   **Organization Security Posture**

   | Component | Critical | High | Medium | Low | Scanner | SLA Status |
   |-----------|----------|------|--------|-----|---------|------------|
   | name      | N        | N    | N      | N   | type    | On track   |

   Scanner coverage: N of M components (X%)
   Workflow coverage: N of M workflows (X%)
   Scan types active: SAST / DAST / SCA / Container

6. For each finding, include: finding type, file path, line number, SLA due date
7. Rank findings by priority: Critical > High with approaching SLA > High > Medium > Low
8. Provide remediation recommendations

### If specific component:

1. `components_search` — find the component
2. `branches_list` — find branches
3. `security_findings_summary_get` — severity breakdown for default branch
4. `security_issues_open_get` — all open issues with details
5. `runs_list(limit=5)` — recent scan run history

6. Present component-level security report with:
   - Finding details (type, file, line, severity, SLA)
   - Scan history (when last scanned, scan frequency)
   - Remediation steps specific to each finding type

7. Offer next actions:
   - "/file-ticket security [finding]" for high-priority findings
   - Post security summary to Slack
   - Check if a fix branch exists in GitHub

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [cloudbees-oss](https://github.com/cloudbees-oss)
- **Source:** [cloudbees-oss/devops-agent-kit](https://github.com/cloudbees-oss/devops-agent-kit)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-cloudbees-oss-devops-agent-kit-security-scan
- Seller: https://agentstack.voostack.com/s/cloudbees-oss
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.