qa-security-scanning
Unified security scanning across five domains - SAST (semgrep-rules, sonarqube-rules, codeql-queries, language-native-sast, multi-tool-finding-triage), DAST (zap-baseline, nuclei-dast), SCA (snyk-test, osv-scanner, dependabot-config, renovate-config, npm-pip-maven-audit, reachability-analyzer, cve-exploitability-triage), secrets (gitleaks-scanning, trufflehog-scanning, secrets-rotation-runner), and SBOM + container (syft-generation, sbom-formats, trivy-image, vex-author): 21 skills and 1 agent (security-finding-triager), the cross-domain adversarial unifier that gates multi-scanner output into one BLOCK / PASS verdict per domain. Every scanner skill includes a mandatory False-positive triage section.
Install this plugin
/plugin install qa-security-scanning@testland-qaFirst time? Add the marketplace with /plugin marketplace add testland/qa
Plugin
- Category
- Security & compliance
- Version
v1.0.2- Contents
- 21 skills · 1 agent
- Part of
- qa-role-security
Skills 21
codeql-queriesConfigures and runs GitHub CodeQL - semantic-database SAST with queries written in the CodeQL declarative query language; supports codeql database create (per-language) + codeql database analyze with --format=sarif; ships query packs (codeql/javascript-queries, codeql/python-queries, codeql/java-queries, codeql/go-queries, etc.); integrates with GitHub Code Scanning via SARIF upload; suppression via inline comment + sarif-filter + Security-tab dismissal.cve-exploitability-triageRanks known CVE findings by real-world exploitability instead of severity alone: enriches each CVE with its EPSS probability (the chance exploitation activity is observed in the next 30 days) and CISA KEV membership (confirmed exploited in the wild), applies OpenVEX status assertions to set aside vulnerabilities the product is not affected by, applies a reachability heuristic for vulnerable code that is never called, and assigns every finding to one of four buckets (Fix-Now, Fix-This-Sprint, Fix-Backlog, Accept-Risk) using documented EPSS thresholds.dependabot-configReference for .github/dependabot.yml - GitHub-native dependency-update orchestrator.gitleaks-scanningConfigures and runs gitleaks - Go-based secret scanner with gitleaks git (scan local git via git log -p), gitleaks dir (filesystem), gitleaks stdin (pipe); 100+ built-in rules + custom rules in .gitleaks.toml ([[rules]] with regex / entropy / keywords / tags); allowlist via [[rules.allowlists]] (commits / paths / stopwords); pre-commit hook + GitHub Action integration; plus baseline management for legacy debt - onboarding a repo with historical findings via --baseline-path snapshots, .gitleaksignore, cross-tool suppression consistency with TruffleHog, and rot-prevention cadence.language-native-sastLanguage-native SAST linters - the first-party "linter as SAST" family that runs inside each ecosystem's standard toolchain with no separate scanner server: Bandit (Python, 60+ B-rules, severity x confidence filtering), gosec (Go, 40+ G-rules, AST + SSA taint tracking, golangci-lint integration), eslint-plugin-security + eslint-plugin-no-unsanitized (JS/TS, 14 detect-* rules + DOM-sink XSS), and PMD's Apex security ruleset (Salesforce, ApexSOQLInjection / ApexCRUDViolation / ApexSharingViolations).multi-tool-finding-triageMerges two or more security scanner reports into one gate.npm-pip-maven-auditConfigures and runs native package-manager audit commands across ecosystems - npm audit --audit-level=high (npm), yarn npm audit (Yarn 2+), pnpm audit (pnpm), pip-audit (Python via PyPA), mvn dependency:check (Maven via OWASP Dependency-Check plugin), cargo audit (Rust, with .cargo/audit.toml suppression, --deny semantics, SARIF, binary auditing, and the rustsec/audit-check Action as a reference), and bundle audit (Ruby Bundler, with .bundler-audit.yml waivers, Rake integration, and CI gating as a reference); fastest no-install-required SCA option.nuclei-dastInstalls and runs ProjectDiscovery Nuclei template-based HTTP scanning: selects templates via -t {path} and -tags/-severity filters, controls request rate with -rl, emits JSONL output via -j for cross-tool finding aggregation, authors custom YAML matchers for app-specific checks, and gates CI on severity thresholds.osv-scannerConfigures and runs Google OSV-Scanner - open-source SCA against the OSV.dev vulnerability database; supports osv-scanner scan -r ./ recursive scan + per-lockfile scan via -L package-lock.json; SBOM input (CycloneDX / SPDX) for non-standard package managers; --format json|sarif|markdown|vertical|html output; suppressions via osv-scanner.toml config.reachability-analyzerRuns dead-dependency analysis across JS, Python, and Rust projects using ecosystem-native static tools (depcheck/knip for JS, vulture for Python, cargo-machete for Rust), then cross-references the unused-dependency list against SCA findings to downrank vulns in code that is never loaded.renovate-configReference for renovate.json - Mend Renovate dependency-update orchestrator (multi-platform: GitHub / GitLab / Bitbucket / Azure DevOps / Gitea); top-level keys (extends for preset references, schedule, prConcurrentLimit, vulnerabilityAlerts); packageRules[] array with matchPackageNames / matchUpdateTypes / automerge matching; ignoreDeps, addLabels, automergeSchedule.sbom-formatsReference for the two SBOM specification families and how to choose between them - CycloneDX v1.6 (OWASP-curated, security-focused: components, services, dependencies, first-class vulnerabilities[] with embedded VEX, formulation, ML/SaaS BOMs; XML / JSON / Protobuf) as the primary format, with SPDX 2.3 + 3.0 (Linux Foundation, license-focused: packages, relationships, license expressions, Tag-Value/JSON encodings, ISO/IEC 5962:2021) covered as a reference.secrets-rotation-runnerBuild-an-X for the secret-rotation workflow after detection - detect via gitleaks/trufflehog/kingfisher → identify provider via verifier → rotate via provider API (AWS IAM / GitHub PAT / Stripe / GCP / Azure / Twilio / Slack / etc.) → invalidate old secret → audit log via observability stack → post-mortem cross-ref.semgrep-rulesConfigures and runs Semgrep - pattern-based SAST across 30+ languages with the Semgrep Registry rulesets (p/owasp-top-ten, p/default, auto) plus custom YAML rules; integrates semgrep ci for PR-blocking gates with --baseline-commit diff-aware scanning, per-finding inline nosemgrep suppressions, --exclude / --include path filters, output formats (--json / --sarif / --gitlab-sast / --junit-xml), and severity filter (INFO/WARNING/ERROR).snyk-testConfigures and runs Snyk, a commercial multi-mode scanner: snyk test for SCA (dependency scanning), snyk code test for SAST (code security scanning), snyk container test for container images, snyk iac test for IaC (infrastructure-as-code), snyk monitor for continuous new-vuln alerts; policy file .snyk for ignore + patch.sonarqube-rulesConfigures and runs SonarQube / SonarCloud - multi-language SAST + Quality Gate platform with built-in Sonar Way rule profiles + custom rule plugins; integrates sonar-scanner with sonar-project.properties config; supports Quality Gate definitions including new-code-period blocking, branch + PR analysis, and per-issue suppression via // NOSONAR comment or @SuppressWarnings("squid:RULE_ID") annotation.syft-generationGenerates, scans, and diffs Software Bills of Materials (SBOMs) with the Anchore stack - Syft generation from container images / directories / archives across OCI / Docker / Singularity formats (output CycloneDX-JSON / SPDX-JSON / Syft-JSON / table / GitHub-JSON, cosign attestation); the paired generate + scan workflow with Grype (grype sbom:./sbom.json, --fail-on high, --only-fixed, .grype.yaml ignore rules with mandatory expires:, EPSS/KEV prioritization); and SBOM-to-SBOM diffing via cyclonedx diff --component-versions to gate CI on net-new components and detect supply-chain drift between builds.trivy-imageConfigures and runs Trivy for container image scanning: Aqua Security's all-in-one scanner combining vuln + secret + misconfiguration + license detection in one pass; trivy image {image} with --severity HIGH,CRITICAL filter; --format sarif/json (incl. scan-embedded CycloneDX; for standalone SBOM generation see syft-generation + sbom-formats); .trivyignore CVE suppression file; --ignore-unfixed for actionable filter; --scanners vuln/misconfig/license/secret toggle.trufflehog-scanningConfigures and runs TruffleHog v3 - secret scanner with **live verification** (validates discovered secrets against provider APIs to confirm actual exposure vs entropy false positive); supports per-source subcommands (git, github, gitlab, filesystem, s3, docker, gcs, postman); --results=verified filter for high-precision output; --exclude-detectors=TYPE for noise reduction; exits 183 on findings via --fail.vex-authorAuthors and validates OpenVEX documents - produces not_affected, affected, fixed, and under_investigation statements with justification codes using vexctl create; attaches VEX assertions to container images; outputs .openvex.json files consumed on a downstream VEX-filter / vulnerability-prioritization path.zap-baselineConfigures and runs OWASP ZAP baseline scanning: zap-baseline.py Docker-packaged spider + passive scan suitable for CI gating; supports -t target_url + -r html_report + -c config_file rule customization (INFO/IGNORE/FAIL warnings) and Ajax spider via -j for JS-heavy SPAs; zap-full-scan.py active companion for staging.
Agents 1
About qa-security-scanning
Unified security scanning: one plugin for the five scanner domains QA teams gate CI on - SAST, DAST, SCA / dependency scanning, secrets, and SBOM + container image scanning - plus one cross-domain adversarial unifier agent (security-finding-triager) that combines any subset of scanner output, deduplicates on the per-domain key, enforces waivers, and emits a single PR-ready BLOCK / PASS verdict per domain (the IaC scanners in qa-iac feed the same gate).
Every scanner skill includes a ## False-positive triage section with concrete suppression patterns + justification template + review cadence. Security scanners without FP triage become shelf-ware.