New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Warp Vulnerability Triage

by warpdotdev in warpdotdev/warp

Gathers security findings from Dependabot, GCP container scanning, Docker Scout and Linear security issues, then triages and remediates them across Warp's repos and images.

AGPL-3.0Auto-check passedSecurity

Install Warp Vulnerability Triage

skills CLI
$ npx skills add warpdotdev/warp --skill triage-vulnerabilities -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install warpdotdev/warp triage-vulnerabilities --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/warpdotdev/warp.git skills-src && mkdir -p .claude/skills && cp -r skills-src/resources/channel-gated-skills/dogfood/triage-vulnerabilities .claude/skills/triage-vulnerabilities && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
triage-vulnerabilities
GitHub stars
65k
Used in
1 other repo
Token cost
~2.1k tokens
SKILL.md length
758 words
Files
1
Skills in repo
46
Repo updated
First seen
Licence
AGPL-3.0

At a glance

Gathers security findings from Dependabot, GCP container scanning, Docker Scout and Linear security issues, then triages and remediates them across Warp's repos and images.

  • Works in 7 steps: Dependabot (GitHub) → GCP Artifact Registry Scanning → Docker Scout (Public Images) → …
  • Checking all open Dependabot alerts across the organization's repos
  • SKILL.md covers Vulnerability Sources, Triage Workflow and Important Constraints
  • Calls docker, gh and gcloud; reaches github.com and nvd.nist.gov

What it does

The skill covers four sources. Dependabot alerts come from the GitHub API for a named set of repos, internal service images are scanned through GCP Artifact Registry in production and staging projects, public images under the warpdotdev org on Docker Hub are checked with Docker Scout for critical and high CVEs, and Linear issues carrying the Security label capture findings other tools do not report. Only the latest tagged image in each registry repo is scanned, since older ones are not actionable.

The workflow starts by gathering findings, using a TODO per source and writing results to temporary TSV files such as dependabot_alerts.tsv, gcp_vulns.tsv and scout_vulns.tsv with CVE, package, severity and fix details. A caveat is that Linear issues are not closed automatically when a fix lands elsewhere, so duplicates across sources are expected. The excerpt ends before the later triage and remediation steps.

When your agent uses it

  • Checking all open Dependabot alerts across the organization's repos
  • Triaging CVEs found in container images
  • Updating base images or dependencies to clear vulnerabilities
  • Reconciling Linear security tickets with scanner findings

Example prompts

  • “Check for vulnerabilities across our repos and images and give me a prioritized list.”
  • “Pull critical and high CVEs for the dev-base image with Docker Scout.”
  • “Triage the open Dependabot alerts and propose which dependency bumps to make first.”

Requirements

  • GitHub CLI access to Dependabot alerts
  • gcloud with access to Artifact Registry
  • Docker Scout
  • A Linear MCP connection

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Dependabot (GitHub)
  2. GCP Artifact Registry Scanning
  3. Docker Scout (Public Images)
  4. Linear Security Issues
  5. Gather Vulnerabilities
  6. Deduplicate
  7. Remediate (One Vulnerability at a Time)

What it can do on your machine

Read from SKILL.md and the folder at commit f571865. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • docker
    • gh
    • gcloud

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • github.com
    • nvd.nist.gov
    • linear.app

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Warp Vulnerability Triage loads about 2.1k tokens when it runs. Until then it costs about 87 tokens; SKILL.md has 758 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~87
When it runs · the whole SKILL.md, loaded when a task matches
~2.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from warpdotdev/warp at commit f571865, republished under its AGPL-3.0 licence (© warpdotdev). 758 words, ~2,071 tokens.

Download SKILL.mdSave it as .claude/skills/triage-vulnerabilities/SKILL.md (or your agent's skills folder).
name
triage-vulnerabilities
description
Triage and remediate security vulnerabilities across Warp infrastructure. Checks Dependabot alerts (GitHub), GCP Artifact Registry container scanning, and Docker Scout for public images. Use when the user asks to check for vulnerabilities, triage CVEs, fix dependency issues, update base images, or remediate security alerts.

triage-vulnerabilities

Triage and remediate security vulnerabilities across four sources: GitHub Dependabot, GCP container registry scanning, Docker Scout, and Linear security issues.

Vulnerability Sources

1. Dependabot (GitHub)

Repos with Dependabot enabled: warp-internal, warp-server, warp-terraform, session-sharing-server.

Fetch open alerts:

bash
# All open alerts for a repo (returns JSON array)
gh api /repos/warpdotdev/<repo>/dependabot/alerts?state=open

# Useful fields per alert:
#   .number, .state, .html_url
#   .dependency.package.name, .dependency.package.ecosystem, .dependency.manifest_path
#   .security_advisory.cve_id, .security_advisory.summary, .security_advisory.severity
#   .security_vulnerability.first_patched_version.identifier

# Summary view: CVE/GHSA, package, severity, fix version, manifest
gh api /repos/warpdotdev/<repo>/dependabot/alerts?state=open \
  --jq '.[] | [.number, .security_advisory.cve_id // .security_advisory.ghsa_id, .dependency.package.name, .security_advisory.severity, (.security_vulnerability.first_patched_version.identifier // "no fix"), .dependency.manifest_path] | @tsv'
2. GCP Artifact Registry Scanning

Internal service images in us-east4 across two projects:

  • Production (astral-field-294621): warp-server, warp-server-jobs, warp-server-migrations, session-sharing-server, pgbouncer-rtc
  • Staging (warp-server-staging): same repos plus cloud-run-source-deploy

Scan steps:

bash
# List images in a repo (get digest for vulnerability query)
gcloud artifacts docker images list \
  us-east4-docker.pkg.dev/<project>/<repo> \
  --include-tags --sort-by=~create_time --limit=5

# List vulnerabilities for a specific image
gcloud artifacts vulnerabilities list \
  "us-east4-docker.pkg.dev/<project>/<repo>/<image>@sha256:<digest>" \
  --format=json

Only scan the latest (most recently tagged) image per repo — older images are not actionable.

3. Docker Scout (Public Images)

Public images on Docker Hub under warpdotdev/ org. Currently enrolled repos: dev-base (and potentially others — check with docker scout repo list --org warpdotdev).

bash
# List CVEs (critical and high only)
docker scout cves warpdotdev/<image> --only-severity critical,high

# Check for base image update recommendations
docker scout recommendations warpdotdev/<image>
4. Linear Security Issues

Linear issues with the Security label track vulnerabilities that may not be auto-reported by other tools (e.g., internal findings, manual triages, or organizational security concerns). Note that Linear issues are not automatically closed when vulnerabilities are fixed elsewhere (e.g., via Dependabot PRs), so there may be duplicates across sources.

Find open security issues:

bash
# Use the Linear MCP to search for issues with Security label
# Example query structure (use Linear MCP tool call):
#   - Search for issues with label: "Security"
#   - Filter for state: "Backlog", "Todo", "In Progress" (exclude "Done", "Cancelled")
#   - Return issue number, title, URL, and current status

# Useful fields per issue:
#   - Issue ID/number (e.g., CLD-2726)
#   - Title (usually contains CVE ID, e.g., "warp-server-GHSA-8r9q-7v3j-jr4g")
#   - URL (e.g., https://linear.app/warpdotdev/issue/CLD-2726/...)
#   - Status (Backlog, Todo, In Progress, Done, Cancelled)
#   - Description (contains CVE details and affected package info)

Triage Workflow

Step 1: Gather Vulnerabilities

IMPORTANT: Use TODOs to track each source.

Query all four sources. Write results to temporary files for reference:

  • dependabot_alerts.tsv — CVE, package, severity, repo, fix version
  • gcp_vulns.tsv — CVE, severity, package, image, fix available
  • scout_vulns.tsv — CVE, severity, package, image
  • linear_security.tsv — Issue ID, CVE/Title, status, URL
Step 2: Deduplicate

The same CVE may appear across multiple sources (e.g. a base image vuln reported by both GCP scanning and Docker Scout, or a Dependabot alert duplicated as a Linear issue). Group by CVE ID and note all affected sources/images. When a Linear issue duplicates a vulnerability that's already being tracked (e.g., via Dependabot), note this and consider it resolved once the underlying fix is applied.

IMPORTANT: Add a TODO for each unique vulnerability.

Step 3: Remediate (One Vulnerability at a Time)

Make sure that you've checked ALL sources and deduplicated vulnerabilities before remediating any.

For each unique vulnerability, starting with critical severity first:

a. Check for Upstream Fix
  • Dependabot alerts: check security_vulnerability.first_patched_version
  • GCP scanning: check the FIX_AVAILABLE field
  • Docker Scout: check docker scout recommendations for base image updates
  • External sources if needed:
    • NVD: https://nvd.nist.gov/vuln/detail/<CVE-ID>
    • GitHub Advisory Database: https://github.com/advisories
    • Distroless issues: https://github.com/GoogleContainerTools/distroless/issues

If no upstream fix exists, report the vulnerability and move on. Do NOT attempt to deactivate/dismiss alerts — only a human can do this.

Show full SKILL.md (377 more words)Show less
b. Apply Fix

Fixes fall into three categories:

Dependabot auto-fix available: The simplest case. Check if Dependabot has already created a PR:

bash
gh pr list --repo warpdotdev/<repo> --author app/dependabot --state open --json title,url

If a PR exists, review and approve it. If not, the fix may require manual intervention.

Dependency update: When Dependabot can't auto-fix (e.g. major version bump needed), update the dependency manually in the appropriate manifest (Cargo.toml, go.mod, package.json, etc.), run tests, and submit a PR.

  • It's acceptable to update additional dependencies if necessary — for example, if PackageA depends on a vulnerable version of PackageB, and also depends on PackageC, and the version of PackageA that uses a fixed version of PackageB requires a newer version of PackageC, you may update all three packages.
  • Prefer updating direct dependencies rather than adding overrides (e.g. update regex to pull in a fixed version of aho-corasick).
  • If there is not a version of the direct dependency that pulls in a fixed transitive dependency, and adding an override ist not straightforward, decide if it's best to wait -- consider the severity and surface area of the vulnerability.

Infrastructure change: For container image vulnerabilities, the fix may involve:

  • Updating a base Docker image (e.g. in a Dockerfile)
  • Updating a sidecar image version (e.g. OpenTelemetry collector in session-sharing-server)
  • Waiting for a distroless base image update (not actionable — report and skip)

When submitting a fix PR, include:

  • The CVE ID(s) being addressed in the PR title
  • Links to the advisory in the PR description
  • Use the create-pr skill for PR creation
c. Report Unresolvable Vulnerabilities

If a vulnerability has no available fix (e.g. waiting on distroless base image update), report:

  • CVE ID and severity
  • Affected package/image
  • Why no fix is available
  • Where to track the upstream fix (link to issue/advisory)

Suggest that a human deactivate the alert until a fix is available. NEVER dismiss or deactivate alerts yourself.

Important Constraints

  • Never dismiss/deactivate vulnerability alerts — only a human can do this
  • Work on one vulnerability at a time — apply fix, verify, then move to the next
  • Prioritize by severity — critical > high > medium > low
  • Check production project first (astral-field-294621), then staging
  • For distroless images: fixes depend on upstream base image updates, which we cannot control
  • Consider how the dependency is used: vulnerabilities in build tools are less severe than vulnerabilities in packages that run in production

© warpdotdev, AGPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in resources/channel-gated-skills/dogfood/triage-vulnerabilities of warpdotdev/warp.

Open the folder on GitHubat commit f571865

Used in 1 other repository

We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in warpdotdev/warp, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Warp Vulnerability Triage next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Warp Vulnerability Triage compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Warp Vulnerability Triage this skillwarpdotdev/warp65k1 repos~2.1kAutomated safety check: PassAGPL-3.0
Cyberowlaikarimhabush/cyberowl263—~2.5kAutomated safety check: PassMIT
Container Scanning with GrypeAgentSecOps/SecOpsAgentKit2191 repos~2.5kAutomated safety check: PassCustom licence
Container Securityhardw00t/ai-security-arsenal104—~2.8kAutomated safety check: PassNone
Sca TrivyAgentSecOps/SecOpsAgentKit2192 repos~3.7kAutomated safety check: PassCustom licence
Container Security Hardeningsickn33/agentic-awesome-skills47k1 repos~1kAutomated safety check: NotesMIT

Similar skills

  • Cyberowlai

    karimhabush/cyberowl

    Check if recent cybersecurity alerts from 10 international CERTs affect your current project.

    263 GitHub stars~2.5k tokensUpdated yesterday
    SecurityAuto-check passed

  • Container Scanning with Grype

    AgentSecOps/SecOpsAgentKit

    Scans container images, filesystems and SBOMs with Grype for known vulnerabilities, ranks them by CVSS, EPSS and CISA KEV, and wires scans into CI/CD thresholds.

    219 GitHub starsUsed in 1 repo~2.5k tokens
    SecurityAuto-check passed

  • Container Security

    hardw00t/ai-security-arsenal

    Container and Kubernetes security assessment — image vulnerability scanning, SBOM diff analysis, K8s cluster auditing, RBAC privilege mapping, NetworkPolicy review, container escape testing, and…

    104 GitHub stars~2.8k tokensUpdated 5 mo ago
    SecurityAuto-check passed

  • Sca Trivy

    AgentSecOps/SecOpsAgentKit

    Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…

    219 GitHub starsUsed in 2 repos~3.7k tokens
    SecurityAuto-check passed

  • Container Security Hardening

    sickn33/agentic-awesome-skills

    Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls.

    47k GitHub starsUsed in 1 repo~1k tokens
    SecurityAuto-check: notes

  • Performing Container Security Scanning With Trivy

    mukul975/Anthropic-Cybersecurity-Skills

    Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed…

    34k GitHub stars~818 tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

More from warpdotdev/warp

All 46 skills in this repo

  • Figma Design System Builder

    warpdotdev/warp

    Builds or updates a design system in Figma from a codebase in ordered phases: discovery, variables and tokens, components, theming and documentation, with checkpoints.

    65k GitHub starsUsed in 2 repos~4.4k tokens
    Auto-check passed

  • Figma use_figma Plugin API Rules

    warpdotdev/warp

    Required groundwork before any use_figma call: the rules and reference files for running JavaScript in a Figma file through the Plugin API without common failures.

    65k GitHub starsUsed in 4 repos~4.4k tokens
    Auto-check passed

  • Warp Factory Files

    warpdotdev/warp

    Authors and edits file-based Warp software factory definitions rooted at factory.yaml, covering agents, automations, scorers and webhooks, and validates them before a pull request.

    65k GitHub starsUsed in 1 repo~2.5k tokens
    Auto-check passed

  • Figma Design to Code

    warpdotdev/warp

    Turns a Figma frame or component into production code that matches the design, using the Figma MCP server and the project's own design system.

    65k GitHub starsUsed in 4 repos~2.9k tokens
    Auto-check passed

  • Warp GUI to Agent CLI Migration

    warpdotdev/warp

    Migrates the compatible subset of settings and global file-based MCP servers from the Warp desktop app into Warp Agent CLI without exposing credentials or state.

    65k GitHub starsUsed in 1 repo~2.1k tokens
    Auto-check passed

  • Figma Design System Rules Generator

    warpdotdev/warp

    Creates project-specific design system rules from your codebase so coding agents implement Figma designs with your components, naming and tokens.

    65k GitHub starsUsed in 3 repos~4.6k tokens
    Auto-check passed

Works with

Categories

Questions about Warp Vulnerability Triage

What does Warp Vulnerability Triage do?

Gathers security findings from Dependabot, GCP container scanning, Docker Scout and Linear security issues, then triages and remediates them across Warp's repos and images. The skill covers four sources. Dependabot alerts come from the GitHub API for a named set of repos, internal service images are scanned through GCP Artifact Registry in production and staging projects, public images under the warpdotdev org on Docker Hub are checked with Docker Scout for critical and high CVEs, and Linear issues carrying the Security label capture findings other tools do not report.

When should I use Warp Vulnerability Triage?

Warp Vulnerability Triage fits situations like: checking all open Dependabot alerts across the organization's repos; triaging CVEs found in container images; updating base images or dependencies to clear vulnerabilities; reconciling Linear security tickets with scanner findings.

How do I install Warp Vulnerability Triage in Claude Code?

Run `npx skills add warpdotdev/warp --skill triage-vulnerabilities -a claude-code`. Or copy the skill folder (resources/channel-gated-skills/dogfood/triage-vulnerabilities in warpdotdev/warp) into .claude/skills/triage-vulnerabilities in your project. Claude Code loads it when a task matches its description.

How do I install Warp Vulnerability Triage in Codex?

Run `npx skills add warpdotdev/warp --skill triage-vulnerabilities -a codex`. Or copy the skill folder (resources/channel-gated-skills/dogfood/triage-vulnerabilities in warpdotdev/warp) into .agents/skills/triage-vulnerabilities in your project. Codex loads it when a task matches its description.

Can I use Warp Vulnerability Triage in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add warpdotdev/warp --skill triage-vulnerabilities -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/triage-vulnerabilities, .gemini/skills/triage-vulnerabilities, .github/skills/triage-vulnerabilities and .opencode/skills/triage-vulnerabilities in your project.

What does Warp Vulnerability Triage need to run?

Going by SKILL.md and its folder, Warp Vulnerability Triage needs the command-line tools its instructions call (docker, gh and gcloud). Our summary lists: GitHub CLI access to Dependabot alerts; gcloud with access to Artifact Registry; Docker Scout; A Linear MCP connection.

Does Warp Vulnerability Triage access the network?

SKILL.md names 3 domains. In commands or code: github.com, nvd.nist.gov and linear.app; the agent is likely to contact these when it follows the instructions. This is read from the text; nothing was executed.

Is Warp Vulnerability Triage safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Warp Vulnerability Triage use?

Warp Vulnerability Triage is published under the AGPL-3.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Warp Vulnerability Triage use?

About 2.1k tokens (SKILL.md is roughly 8.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Warp Vulnerability Triage?

Skills that share tags, products or a category with Warp Vulnerability Triage: Cyberowlai (karimhabush/cyberowl, 263 stars), Container Scanning with Grype (AgentSecOps/SecOpsAgentKit, 219 stars), Container Security (hardw00t/ai-security-arsenal, 104 stars) and Sca Trivy (AgentSecOps/SecOpsAgentKit, 219 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Warp Vulnerability Triage?

warpdotdev (a GitHub organization) maintains it in warpdotdev/warp, which has 65,380 GitHub stars. The repository holds 46 skills in this directory. The repository was last updated on October 7, 2026.

Source: warpdotdev/warp on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.