Aggregates scanner results into DefectDojo, deduplicates findings, tracks remediation SLAs and prepares compliance reports across products and pipelines.
$ npx skills add AgentSecOps/SecOpsAgentKit --skill vuln-defectdojo -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit vuln-defectdojo --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/devsecops/vuln-defectdojo .claude/skills/vuln-defectdojo && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "vuln-defectdojo" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/vuln-defectdojo into .claude/skills/vuln-defectdojo/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vuln-defectdojo", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/vuln-defectdojoType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add AgentSecOps/SecOpsAgentKit --skill vuln-defectdojo -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit vuln-defectdojo --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/devsecops/vuln-defectdojo .agents/skills/vuln-defectdojo && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "vuln-defectdojo" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/vuln-defectdojo into .agents/skills/vuln-defectdojo/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vuln-defectdojo", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add AgentSecOps/SecOpsAgentKit --skill vuln-defectdojo -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit vuln-defectdojo --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/devsecops/vuln-defectdojo .cursor/skills/vuln-defectdojo && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "vuln-defectdojo" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/vuln-defectdojo into .cursor/skills/vuln-defectdojo/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vuln-defectdojo", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/AgentSecOps/SecOpsAgentKit.git --path skills/devsecops/vuln-defectdojo--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add AgentSecOps/SecOpsAgentKit --skill vuln-defectdojo -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit vuln-defectdojo --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/devsecops/vuln-defectdojo .gemini/skills/vuln-defectdojo && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "vuln-defectdojo" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/vuln-defectdojo into .gemini/skills/vuln-defectdojo/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vuln-defectdojo", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install AgentSecOps/SecOpsAgentKit vuln-defectdojoInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add AgentSecOps/SecOpsAgentKit --skill vuln-defectdojo -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/devsecops/vuln-defectdojo .github/skills/vuln-defectdojo && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "vuln-defectdojo" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/vuln-defectdojo into .github/skills/vuln-defectdojo/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vuln-defectdojo", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add AgentSecOps/SecOpsAgentKit --skill vuln-defectdojo -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit vuln-defectdojo --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/devsecops/vuln-defectdojo .opencode/skills/vuln-defectdojo && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "vuln-defectdojo" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/devsecops/vuln-defectdojo into .opencode/skills/vuln-defectdojo/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vuln-defectdojo", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
vuln-defectdojoAggregates scanner results into DefectDojo, deduplicates findings, tracks remediation SLAs and prepares compliance reports across products and pipelines.
DefectDojo serves as one place for findings from scanners such as Semgrep, Bandit, ZAP, Trivy, Grype, Gitleaks, Nuclei, Checkov and Horusec. The skill explains its model: a Product is an application, an Engagement is a time-boxed activity such as a sprint or pipeline, a Test is one scanner run, and a Finding is a deduplicated issue that moves from Active through Mitigated to Closed.
The workflow starts with running DefectDojo locally through docker compose and creating an API key in the UI. You then create a product and engagement over the API and import each scanner's JSON with scripts/import_findings.py, using the right --scan-type. references/tool-parser-map.md maps every tool to its parser name and output format, and an engagement template JSON is included for CI/CD setups. A GitHub Actions import step after each scanner is shown for pipelines.
The description positions it for tracking SLA compliance, merging overlapping findings, managing a vulnerability backlog and producing reports for SOC2, PCI-DSS and GDPR audits.
5 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit 6e25a4b. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Ships 1 file in scripts/ (Python), which the agent can run.
Shell commands in SKILL.md call:
curlgitdockerpipFrom the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
github.comAlso links to:
defectdojo.github.ioowasp.orgdemo.defectdojo.orgFrom URLs in SKILL.md, links to its own repository left out.
Names these keys or tokens, usually read from environment variables:
DD_API_KEYFrom names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
DefectDojo Vulnerability Management loads about 2.3k tokens when it runs, and up to ~3.4k if it reads all its reference files. Until then it costs about 184 tokens; SKILL.md has 713 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 713 words (~2,349 tokens).
“DefectDojo aggregates findings from every SecOpsAgentKit scanner into one platform—deduplicating across tools, tracking SLA compliance, and producing compliance-ready reports. It transforms isolated scanner outputs into a managed vulnerability backlog with ownership and remediation history.”
SKILL.md and 3 other files (scripts, references, assets) in skills/devsecops/vuln-defectdojo of AgentSecOps/SecOpsAgentKit.
Open the folder on GitHubat commit 6e25a4b
DefectDojo Vulnerability Management next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| DefectDojo Vulnerability Management this skillAgentSecOps/SecOpsAgentKit | 219 | — | ~2.3k | Automated safety check: Pass | Custom licence | |
| Scanning Containers With Trivy In Cicdmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.7k | Automated safety check: Pass | Apache-2.0 | |
| Performing Container Security Scanning With Trivymukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~818 | Automated safety check: Pass | Apache-2.0 | |
| Building Devsecops Pipeline With GitLab CImukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.2k | Automated safety check: Pass | Apache-2.0 | |
| Pipeline Security Gatesrevfactory/harness-100 | 1.3k | — | ~1.1k | Automated safety check: Pass | Apache-2.0 | |
| Implementing Devsecops Security Scanningmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.1k | Automated safety check: Pass | Apache-2.0 |
mukul975/Anthropic-Cybersecurity-Skills
Integrates Aqua Security's Trivy scanner into CI/CD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and…
mukul975/Anthropic-Cybersecurity-Skills
Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed…
mukul975/Anthropic-Cybersecurity-Skills
Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security…
revfactory/harness-100
CI/CD 파이프라인 보안 게이트 설계 가이드. An agent skill from revfactory/harness-100.
mukul975/Anthropic-Cybersecurity-Skills
Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection.
rohitg00/awesome-claude-code-toolkit
CI/CD pipeline design with GitHub Actions, Docker, Kubernetes, Helm, and GitOps patterns
AgentSecOps/SecOpsAgentKit
Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.
AgentSecOps/SecOpsAgentKit
Hardcoded secret detection and prevention in git repositories and codebases using Gitleaks.
AgentSecOps/SecOpsAgentKit
Guides authorized packet capture and analysis with TShark, Wireshark's command-line tool, for security investigations, malware detection and forensic examination of network traffic.
AgentSecOps/SecOpsAgentKit
Scans container images, filesystems and SBOMs with Grype for known vulnerabilities, ranks them by CVSS, EPSS and CISA KEV, and wires scans into CI/CD thresholds.
AgentSecOps/SecOpsAgentKit
Lints Dockerfiles with Hadolint for security misconfigurations and best-practice violations, locally and in CI, with strict, balanced and permissive rule templates.
AgentSecOps/SecOpsAgentKit
Guides authorized password-hash recovery with hashcat for security audits, forensic cases and policy testing, starting with an explicit authorization check before any cracking runs.
Works with
Categories
Aggregates scanner results into DefectDojo, deduplicates findings, tracks remediation SLAs and prepares compliance reports across products and pipelines. DefectDojo serves as one place for findings from scanners such as Semgrep, Bandit, ZAP, Trivy, Grype, Gitleaks, Nuclei, Checkov and Horusec. The skill explains its model: a Product is an application, an Engagement is a time-boxed activity such as a sprint or pipeline, a Test is one scanner run, and a Finding is a deduplicated issue that moves from Active through Mitigated to Closed.
DefectDojo Vulnerability Management fits situations like: aggregating findings from several scanners across products and pipelines; tracking remediation status and SLA compliance against policy thresholds; deduplicating overlapping findings that different security tools report; preparing vulnerability reports for a compliance audit.
Run `npx skills add AgentSecOps/SecOpsAgentKit --skill vuln-defectdojo -a claude-code`. Or copy the skill folder (skills/devsecops/vuln-defectdojo in AgentSecOps/SecOpsAgentKit) into .claude/skills/vuln-defectdojo in your project. Claude Code loads it when a task matches its description.
Run `npx skills add AgentSecOps/SecOpsAgentKit --skill vuln-defectdojo -a codex`. Or copy the skill folder (skills/devsecops/vuln-defectdojo in AgentSecOps/SecOpsAgentKit) into .agents/skills/vuln-defectdojo in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add AgentSecOps/SecOpsAgentKit --skill vuln-defectdojo -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/vuln-defectdojo, .gemini/skills/vuln-defectdojo, .github/skills/vuln-defectdojo and .opencode/skills/vuln-defectdojo in your project.
Going by SKILL.md and its folder, DefectDojo Vulnerability Management needs Python for the scripts in its folder, the command-line tools its instructions call (curl, git, docker and pip) and credentials named DD_API_KEY. Our summary lists: Docker with Compose, or an existing DefectDojo instance; A DefectDojo API key; Python with the requests package; Scanner output files, usually JSON.
SKILL.md names 4 domains. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. As links in the text: defectdojo.github.io, owasp.org and demo.defectdojo.org. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
DefectDojo Vulnerability Management has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
About 2.3k tokens (SKILL.md is roughly 9.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1k tokens, read only when the agent opens those files.
Skills that share tags, products or a category with DefectDojo Vulnerability Management: Scanning Containers With Trivy In Cicd (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Performing Container Security Scanning With Trivy (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Building Devsecops Pipeline With GitLab CI (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Pipeline Security Gates (revfactory/harness-100, 1.3k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
AgentSecOps (a GitHub organization) maintains it in AgentSecOps/SecOpsAgentKit, which has 219 GitHub stars. The repository holds 24 skills in this directory. The repository was last updated on April 15, 2026.
Source: AgentSecOps/SecOpsAgentKit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
