Skip to content

Add dependency-scanning skill to advanced-security plugin #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MabCloud wants to merge 2 commits into
base: main
Choose a base branch
from
+395 −2
Open

Add dependency-scanning skill to advanced-security plugin #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8bd1179
feat: add dependency-scanning skill for CVE/vulnerability detection
MabCloud Apr 16, 2026
36a3752
Add dependency-scanning skill to advanced-security plugin
MabCloud Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/plugin/marketplace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,8 @@
"description": "Advanced Security plugin for GitHub Copilot.",
"version": "1.0.0",
"skills": [
"./skills/secret-scanning"
"./skills/secret-scanning",
"./skills/dependency-scanning"
]
}
]
Expand Down
7 changes: 6 additions & 1 deletion plugins/advanced-security/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,19 @@ Security-focused plugin that brings GitHub Advanced Security capabilities into A

## What it does

Advanced Security helps agents identify and prevent credential exposure during development by:
Advanced Security helps agents identify and prevent security risks during development by:

- Scanning code snippets, files, and git changes for potential secrets
- Using GitHub secret detection patterns through MCP tooling
- Supporting pre-commit checks to catch leaked credentials early
- Auditing project dependencies for known CVEs and security advisories across multiple ecosystems

## Skills

### `secret-scanning`

Activated when a user asks to check code, files, or git changes for exposed credentials. Uses the `run_secret_scanning` MCP tool to scan content for potential secrets before code is committed.

### `dependency-scanning`

Activated when a user asks to audit dependencies, check for known vulnerabilities, or find CVEs in project packages. Automatically detects the package manager in use (npm, Yarn, pnpm, pip, Cargo, bundler, Go modules, or .NET) and runs the appropriate native audit tool to surface vulnerable packages with severity levels and remediation guidance.
Loading