CodeQL Security Scan
trailofbits/skills
Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.
Dependabot and security analysis skill for HASTE. An agent skill from microsoft/haste.
Install Security Analysis
$ npx skills add microsoft/haste --skill security-analysis -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install microsoft/haste security-analysis --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/microsoft/haste.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/security-analysis .claude/skills/security-analysis && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-analysis" agent skill from https://github.com/microsoft/haste/tree/main/.github/skills/security-analysis into .claude/skills/security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-analysis", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/microsoft/haste/tree/main/.github/skills/security-analysisType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add microsoft/haste --skill security-analysis -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install microsoft/haste security-analysis --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/haste.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.github/skills/security-analysis .agents/skills/security-analysis && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-analysis" agent skill from https://github.com/microsoft/haste/tree/main/.github/skills/security-analysis into .agents/skills/security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-analysis", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/haste --skill security-analysis -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install microsoft/haste security-analysis --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/haste.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.github/skills/security-analysis .cursor/skills/security-analysis && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-analysis" agent skill from https://github.com/microsoft/haste/tree/main/.github/skills/security-analysis into .cursor/skills/security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-analysis", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/microsoft/haste.git --path .github/skills/security-analysis--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add microsoft/haste --skill security-analysis -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install microsoft/haste security-analysis --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/haste.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.github/skills/security-analysis .gemini/skills/security-analysis && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-analysis" agent skill from https://github.com/microsoft/haste/tree/main/.github/skills/security-analysis into .gemini/skills/security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-analysis", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install microsoft/haste security-analysisInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add microsoft/haste --skill security-analysis -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/microsoft/haste.git skills-src && mkdir -p .github/skills && cp -r skills-src/.github/skills/security-analysis .github/skills/security-analysis && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-analysis" agent skill from https://github.com/microsoft/haste/tree/main/.github/skills/security-analysis into .github/skills/security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-analysis", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/haste --skill security-analysis -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install microsoft/haste security-analysis --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/haste.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.github/skills/security-analysis .opencode/skills/security-analysis && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-analysis" agent skill from https://github.com/microsoft/haste/tree/main/.github/skills/security-analysis into .opencode/skills/security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-analysis", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-analysis- GitHub stars
- 106
- Token cost
- ~1k tokens
- SKILL.md length
- 349 words
- Files
- 1
- Skills in repo
- 9
- Repo updated
- First seen
- Licence
- MIT
At a glance
Dependabot and security analysis skill for HASTE. An agent skill from microsoft/haste.
- : Dependabot alert
- SKILL.md covers Overview, Key Concepts, Patterns & Techniques and Decision Framework, plus 1 more section
- Calls pip and npm
- Vulnerability triage
What it does
Security Analysis is an agent skill from microsoft/haste, published by the product's own GitHub organization. Dependabot and security analysis skill for HASTE. Parse alerts, group related vulnerabilities, apply severity rules, and produce structured reports. Use when: 'Dependabot alert', 'security scan', 'vulnerability triage', 'dependency audit', 'npm audit', 'pip audit', 'CVE analysis'.
Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Dependency management, Vulnerability scanning and Security review. It works with Microsoft Azure, Python and JavaScript. The repository describes itself as: High Speed Assessment and Satellite Tracking for Emergencies. The licence is MIT.
When your agent uses it
- : Dependabot alert
- Vulnerability triage
- Dependency audit
Example prompts
- “Dependabot alert”
- “security scan”
- “vulnerability triage”
- “/security-analysis”
Requirements
- Python 3
What it can do on your machine
Read from SKILL.md and the folder at commit 079bd89. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
pipnpm
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use pip and npm, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Analysis loads about 1k tokens when it runs. Until then it costs about 75 tokens; SKILL.md has 349 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from microsoft/haste at commit 079bd89, republished under its MIT licence (© microsoft). 349 words, ~1,019 tokens.
Download SKILL.mdSave it as
.claude/skills/security-analysis/SKILL.md (or your agent's skills folder).- name
- security-analysis
- description
- Dependabot and security analysis skill for HASTE. Parse alerts, group related vulnerabilities, apply severity rules, and produce structured reports. Use when: 'Dependabot alert', 'security scan', 'vulnerability triage', 'dependency audit', 'npm audit', 'pip audit', 'CVE analysis'.
- source
- HASTE security practices, OWASP, NVD
- domain
- security
- level
- intermediate
- agents
- security, security-validation
- created_date
- 2026-04-27
- status
- draft
Security Analysis
Overview
Structured process for triaging Dependabot alerts, grouping related vulnerabilities, applying severity rules, and producing actionable reports for HASTE's Python and JavaScript dependency stacks.
Key Concepts
HASTE Dependency Landscape
| Stack | Location | Tool | Key Risks |
|---|---|---|---|
| Python (API) | api/hastefuncapi/requirements.txt | pip audit | GDAL parsing, Azure SDK, rasterio |
| Python (Queues) | api/hastefuncqueues/requirements.txt | pip audit | Same as API |
| Python (Core) | hastelib/pyproject.toml | pip audit | Geospatial libs, ML deps |
| JavaScript (UI) | ui/package.json | npm audit | FluentUI, MSAL, build tools |
| JavaScript (Root) | package.json | npm audit | Azurite (dev only) |
Severity Rules
| Severity | Action | SLA |
|---|---|---|
| Critical | Investigate immediately, create issue | Same day |
| High | Investigate promptly, create issue | 3 business days |
| Medium | Queue for next sprint | Next sprint |
| Low | Document and track | Backlog |
Patterns & Techniques
Alert Triage Process
Step 1: Gather alerts
# Python
pip audit --format json
# JavaScript
npm audit --jsonStep 2: Group related vulnerabilities
- Same package, different CVEs → group together
- Same dependency chain → note the root cause package
- Transitive vs direct dependency → prioritize direct
Step 3: Assess HASTE impact For each vulnerability, determine:
- Is the vulnerable code path reachable in HASTE?
- What data is at risk? (imagery, project metadata, user data)
- Is this in a production path or dev-only dependency?
- Can the vulnerability be exploited through HASTE's public interfaces?
Step 4: Produce report
## Security Triage Report — [Date]
### Critical/High Findings
| Package | CVE | Severity | Component | Reachable? | Action |
|---------|-----|----------|-----------|------------|--------|
### Medium/Low Findings
| Package | CVE | Severity | Component | Action |
|---------|-----|----------|-----------|--------|
### Dependencies to Watch
[Packages with recent churn, new maintainers, or declining activity]HASTE-Specific Risk Areas
| Area | Why It Matters |
|---|---|
| GDAL/rasterio | File parsing vulnerabilities — common attack vector for malicious GeoTIFFs |
| Azure SDKs | Auth and credential handling — high-value targets |
| MSAL | Token handling and auth bypass — directly affects user security |
| boto3 | AWS S3 access for imagery sources — credential exposure risk |
| opencv-python | Image processing vulnerabilities — similar to GDAL risks |
Decision Framework
| Scenario | Action |
|---|---|
| Critical CVE in production dependency | Immediate triage, create issue, recommend upgrade |
| High CVE in production dependency | Investigate within 3 days, create issue |
| Any CVE in dev-only dependency (azurite, vite, eslint) | Document, lower priority |
| Upgrade introduces breaking changes | Document migration steps, flag for planning |
| No fix available | Document workaround or risk acceptance rationale |
Common Pitfalls
- Treating all alerts equally — Production critical > production high > dev-only
- Ignoring transitive dependencies — A safe direct dep can pull in vulnerable packages
- Auto-upgrading without testing — Always run
hatch run test:pytestafter upgrades - Assuming dev-only deps are safe — Supply chain attacks can target build tools
© microsoft, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .github/skills/security-analysis of microsoft/haste.
Open the folder on GitHubat commit 079bd89
Compare with similar skills
Security Analysis next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Analysis this skillmicrosoft/haste | 106 | — | ~1k | Automated safety check: Pass | MIT | |
| CodeQL Security Scantrailofbits/skills | 7.4k | — | ~4.6k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| npm Supply Chain Checkmajiayu000/spellbook | 286 | — | ~1.5k | Automated safety check: Pass | MIT | |
| Security Reviewgithub/awesome-copilot | 40k | 1 repos | ~2.3k | Automated safety check: Notes | MIT | |
| Native Dependency Updatemono/SkiaSharp | 5.6k | — | ~4.1k | Automated safety check: Pass | MIT | |
| Security AuditTheDecipherist/claude-code-mastery | 550 | — | ~1.3k | Automated safety check: Notes | MIT |
Similar skills
- Official
npm Supply Chain Check
majiayu000/spellbook
Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.
- Official
Security Review
github/awesome-copilot
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…
Native Dependency Update
mono/SkiaSharp
Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.
Security Audit
TheDecipherist/claude-code-mastery
Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.
- Official
Openai Security Best Practices
trailofbits/skills-curated
Perform language and framework specific security best-practice reviews and suggest improvements.
More from microsoft/haste
All 9 skills in this repo- Official
API Design
microsoft/haste
Guide for designing and documenting RESTful APIs. An agent skill from microsoft/haste.
- Official
Copilot CLI Modes
microsoft/haste
Comprehensive guide to all Copilot CLI running modes: Interactive, Plan, Autopilot, Fleet, Research, Chronicle, and Delegate.
- Official
Debug Test Failures
microsoft/haste
Systematic debugging workflow for test failures. An agent skill from microsoft/haste.
- Official
Dependency Update
microsoft/haste
Guide for safely updating project dependencies. An agent skill from microsoft/haste.
- Official
Imagery Provider Adaptation
microsoft/haste
Imagery provider adaptation skill for HASTE. An agent skill from microsoft/haste.
- Official
Validation Diagnostics
microsoft/haste
Validation and diagnostic skill for HASTE. An agent skill from microsoft/haste.
Related
Works with
Categories
Questions about Security Analysis
What does Security Analysis do?
Dependabot and security analysis skill for HASTE. An agent skill from microsoft/haste. Security Analysis is an agent skill from microsoft/haste, published by the product's own GitHub organization. Dependabot and security analysis skill for HASTE.
When should I use Security Analysis?
Security Analysis fits situations like: : Dependabot alert; vulnerability triage; dependency audit.
How do I install Security Analysis in Claude Code?
Run `npx skills add microsoft/haste --skill security-analysis -a claude-code`. Or copy the skill folder (.github/skills/security-analysis in microsoft/haste) into .claude/skills/security-analysis in your project. Claude Code loads it when a task matches its description.
How do I install Security Analysis in Codex?
Run `npx skills add microsoft/haste --skill security-analysis -a codex`. Or copy the skill folder (.github/skills/security-analysis in microsoft/haste) into .agents/skills/security-analysis in your project. Codex loads it when a task matches its description.
Can I use Security Analysis in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add microsoft/haste --skill security-analysis -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-analysis, .gemini/skills/security-analysis, .github/skills/security-analysis and .opencode/skills/security-analysis in your project.
What does Security Analysis need to run?
Going by SKILL.md and its folder, Security Analysis needs the command-line tools its instructions call (pip and npm). Our summary lists: Python 3.
Does Security Analysis access the network?
SKILL.md contains no URLs. Its commands use pip and npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Security Analysis safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Analysis use?
Security Analysis is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Analysis use?
About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Analysis?
Skills that share tags, products or a category with Security Analysis: CodeQL Security Scan (trailofbits/skills, 7.4k stars), npm Supply Chain Check (majiayu000/spellbook, 286 stars), Security Review (github/awesome-copilot, 40k stars) and Native Dependency Update (mono/SkiaSharp, 5.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Analysis?
microsoft (a GitHub organization, an official publisher) maintains it in microsoft/haste, which has 106 GitHub stars. The repository holds 9 skills in this directory. The repository was last updated on October 2, 2026.
Source: microsoft/haste on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.