Scan for security vulnerabilities and automatically create GitHub issues for tracking
Inherits all available tools
Additional assets for this skill
This skill inherits all available tools. When active, it can use any tool Claude has access to.
name: pop-security-scan description: Scan for security vulnerabilities and automatically create GitHub issues for tracking inputs:
Automated security vulnerability detection with GitHub issue creation and routine integration.
/popkit:routine nightly security for automated scans/popkit:security-scan commandUser provides:
--fix, --dry-run, --no-issues, --severity <level>scan, list, fix, reportExecute npm audit and parse results:
npm audit --json 2>/dev/null
Parse the JSON output to extract:
Before creating new issues, check for duplicates:
gh issue list --label "security,automated" --json number,title,state
Search for:
For HIGH and CRITICAL vulnerabilities without existing issues:
## Security Vulnerability: [Package] [CVE-ID]
**Severity:** HIGH
**Package:** nodemailer
**Vulnerable Versions:** <=7.0.10
**Patched Version:** 7.0.11
### Description
[Advisory description from npm audit]
### Impact
[Potential impact - DoS, RCE, data leak, etc.]
### Remediation
```bash
npm update nodemailer
# or
npm install nodemailer@7.0.11
Auto-generated by PopKit Security Scan
Run /popkit:security-scan --fix to attempt automatic remediation
Labels: `security`, `automated`, `priority:high` (or `priority:critical`)
### 4. Generate Report
Output a summary:
Project: popkit Date: 2024-12-09
Vulnerabilities Found: Critical: 0 High: 2 Moderate: 5 Low: 3
Issues Created: 2 #42 - CVE-2024-XXXX: nodemailer DoS vulnerability #43 - GHSA-XXXX: mdast-util-to-hast unsanitized attribute
Existing Issues: 1 #38 - lodash prototype pollution (open)
Fix Available: 7 of 10 vulnerabilities
Recommendations:
npm audit fix to resolve 7 auto-fixable vulnerabilitiesSleep Score Impact: -15 points (2 high severity issues)
### 5. Update Scores
Impact on routine scores:
| Severity | Points Deducted |
|----------|-----------------|
| Critical | -20 per issue |
| High | -10 per issue |
| Moderate | -5 per issue |
| Low | -2 per issue |
Maximum deduction: 30 points (caps at 70 minimum score)
## Subcommand Handlers
### scan (default)
Full scan with issue creation:
/popkit:security-scan /popkit:security-scan --severity high # Only high+ severity /popkit:security-scan --dry-run # Preview without creating issues
### list
List known vulnerabilities and tracking issues:
/popkit:security-scan list /popkit:security-scan list --open # Only open issues /popkit:security-scan list --resolved # Show fixed vulnerabilities
### fix
Attempt automatic remediation:
/popkit:security-scan fix # Run npm audit fix /popkit:security-scan fix --force # Include breaking changes /popkit:security-scan fix --pr # Create PR with fixes
### report
Generate detailed report without creating issues:
/popkit:security-scan report /popkit:security-scan report --json # Machine-readable output /popkit:security-scan report --md # Markdown format
## Integration with Routines
### Nightly Routine
Called during `/popkit:routine nightly`:
Security Audit: Scanning dependencies...
Vulnerabilities: 2 high, 5 moderate Issues Created: 1 new (CVE-2024-XXXX) Existing Tracking: 1 open issue
Sleep Score Impact: -10 points
### Morning Routine
Summary in Ready to Code checklist:
Security Status: Open Issues: 2 (1 critical, 1 high) Action Required: Yes - review before deploying
Ready to Code Impact: -5 points
## Duplicate Detection
Prevent creating duplicate issues by checking:
1. **CVE ID**: Search issue titles for `CVE-XXXX-XXXXX`
2. **GHSA ID**: Search for `GHSA-XXXX-XXXX-XXXX`
3. **Package + Severity**: `"nodemailer" AND "high" AND "security"`
Only create if no matching open issue found.
## Example Flows
### Full Scan
User: /popkit:security-scan
Scanning npm dependencies... Found: package.json, package-lock.json
Running npm audit... Analyzing 847 packages
Vulnerabilities Found: Critical: 0 High: 2 Moderate: 3 Low: 1
Checking for existing GitHub issues... Found 1 existing tracking issue
Creating issues for new vulnerabilities... Created #42: CVE-2024-1234 nodemailer DoS (HIGH) Skipped: GHSA-5678 already tracked in #38
Summary: New Issues: 1 Existing: 1 Auto-fixable: 4
Run /popkit:security-scan fix to apply automatic fixes.
### Dry Run
User: /popkit:security-scan --dry-run
[DRY RUN - No issues will be created]
Would create:
Would skip:
### Auto Fix
User: /popkit:security-scan fix
Running npm audit fix...
Fixed 4 vulnerabilities:
Remaining (require manual review):
Run /popkit:security-scan fix --force to attempt breaking change fixes.
## Architecture Integration
| Component | Purpose |
|-----------|---------|
| `npm audit --json` | Vulnerability data source |
| `gh issue create` | GitHub issue creation |
| `gh issue list` | Duplicate detection |
| `/popkit:routine nightly` | Automated scanning |
| `/popkit:routine morning` | Status reporting |
| Sleep Score | Nightly impact calculation |
| Ready to Code Score | Morning impact calculation |
## Output Style
Use structured, actionable format:
- Show severity with visual indicators
- Group by severity level
- Provide clear remediation steps
- Link to existing tracking issues
- Show score impact prominently