Agent skill · vasilyu1983
qa-security-testing
Builds automated security testing pipelines for SAST, DAST, SCA, secret scanning, and containers. Use when integrating scanners into CI or managing security regression gates.
What it needs
About 8k tokens when loaded.
What this skill does
QA Security Testing Automated security testing pipelines that integrate scanners into CI/CD, enforce vulnerability gates, and drive findings through remediation. This skill covers the testing automation side of security; for secure design, threat modeling, and architecture review, use software-security-appsec. Start with the quick start workflow below, then dive into specific reference guides. Use current official sources from data/sources.json for tool documentation. Quick Start 1. Run a lightweight threat model to identify attack surface and risk areas. 2. Select tools per category (SAST, SCA, DAST, secrets, container/IaC). 3. Integrate into CI with clear gate policies per stage. 4. Establish a triage workflow: confirm, classify, assign, track. 5. Define vulnerability SLAs as a starting policy, then tune them to exploitability, business impact, and compliance obligations. 6. Add security regression tests for every confirmed vulnerability. Inputs to Gather Application type: web app, API, mobile, CLI, infrastructure. Languages, frameworks, and build toolchain. Deployment model: containers, serverless, VMs, PaaS. Current security tooling and CI platform. Compliance requirements: SOC 2, PCI DSS, HIPAA, ISO 27001 if applicable. Existing vulnerability management process and acceptable risk thresholds. Code hosting platform: GitHub, GitLab, Bitbucket (affects native tool availability). Security Testing Categories 1. SAST (Static Application Security Testing) Analyze source code for vulnerabilities without executing it. Recommended tools: Semgrep (fast, customizable rules, free tier), CodeQL (deep dataflow analysis, GitHub-native), Snyk Code. CI pattern: run on every PR; a common starter is block merge on high/critical findings, then tune to your risk policy. Key practices: maintain custom rules for your codebase patterns, manage suppressions with documented reasons, use baseline files to avoid noise from pre-existing findings. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills vasilyu1983/qa-security-testing