Security Audit
Aedelon/claude-code-blueprint
Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults.
SCA 漏洞 AI 降噪与风险优先级评估。对 Grype/Snyk/Xray 等 SCA 工具的漏洞发现进行多维度风险评估，按 P0-P3 分级，过滤噪音（DoS、本地提权、低影响信息泄露），聚焦真正可利用的高风险漏洞。当用户需要对 SCA 扫描结果降噪、漏洞优先级排序、或供应链风险评估时使用。
Install Sca AI Denoise
$ npx skills add xwtro0tk1t-cloud/harness --skill sca-ai-denoise -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install xwtro0tk1t-cloud/harness sca-ai-denoise --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/xwtro0tk1t-cloud/harness.git skills-src && mkdir -p .claude/skills && cp -r skills-src/bundled-skills/sca-ai-denoise .claude/skills/sca-ai-denoise && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "sca-ai-denoise" agent skill from https://github.com/xwtro0tk1t-cloud/harness/tree/main/bundled-skills/sca-ai-denoise into .claude/skills/sca-ai-denoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sca-ai-denoise", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/xwtro0tk1t-cloud/harness/tree/main/bundled-skills/sca-ai-denoiseType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add xwtro0tk1t-cloud/harness --skill sca-ai-denoise -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install xwtro0tk1t-cloud/harness sca-ai-denoise --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/xwtro0tk1t-cloud/harness.git skills-src && mkdir -p .agents/skills && cp -r skills-src/bundled-skills/sca-ai-denoise .agents/skills/sca-ai-denoise && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "sca-ai-denoise" agent skill from https://github.com/xwtro0tk1t-cloud/harness/tree/main/bundled-skills/sca-ai-denoise into .agents/skills/sca-ai-denoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sca-ai-denoise", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add xwtro0tk1t-cloud/harness --skill sca-ai-denoise -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install xwtro0tk1t-cloud/harness sca-ai-denoise --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/xwtro0tk1t-cloud/harness.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/bundled-skills/sca-ai-denoise .cursor/skills/sca-ai-denoise && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "sca-ai-denoise" agent skill from https://github.com/xwtro0tk1t-cloud/harness/tree/main/bundled-skills/sca-ai-denoise into .cursor/skills/sca-ai-denoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sca-ai-denoise", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/xwtro0tk1t-cloud/harness.git --path bundled-skills/sca-ai-denoise--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add xwtro0tk1t-cloud/harness --skill sca-ai-denoise -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install xwtro0tk1t-cloud/harness sca-ai-denoise --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/xwtro0tk1t-cloud/harness.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/bundled-skills/sca-ai-denoise .gemini/skills/sca-ai-denoise && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "sca-ai-denoise" agent skill from https://github.com/xwtro0tk1t-cloud/harness/tree/main/bundled-skills/sca-ai-denoise into .gemini/skills/sca-ai-denoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sca-ai-denoise", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install xwtro0tk1t-cloud/harness sca-ai-denoiseInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add xwtro0tk1t-cloud/harness --skill sca-ai-denoise -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/xwtro0tk1t-cloud/harness.git skills-src && mkdir -p .github/skills && cp -r skills-src/bundled-skills/sca-ai-denoise .github/skills/sca-ai-denoise && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "sca-ai-denoise" agent skill from https://github.com/xwtro0tk1t-cloud/harness/tree/main/bundled-skills/sca-ai-denoise into .github/skills/sca-ai-denoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sca-ai-denoise", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add xwtro0tk1t-cloud/harness --skill sca-ai-denoise -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install xwtro0tk1t-cloud/harness sca-ai-denoise --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/xwtro0tk1t-cloud/harness.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/bundled-skills/sca-ai-denoise .opencode/skills/sca-ai-denoise && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "sca-ai-denoise" agent skill from https://github.com/xwtro0tk1t-cloud/harness/tree/main/bundled-skills/sca-ai-denoise into .opencode/skills/sca-ai-denoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sca-ai-denoise", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
sca-ai-denoise- GitHub stars
- 265
- Token cost
- ~787 tokens
- SKILL.md length
- 225 words
- Files
- 1
- Skills in repo
- 7
- Repo updated
- First seen
- Licence
- None found
At a glance
SCA 漏洞 AI 降噪与风险优先级评估。对 Grype/Snyk/Xray 等 SCA 工具的漏洞发现进行多维度风险评估，按 P0-P3 分级，过滤噪音（DoS、本地提权、低影响信息泄露），聚焦真正可利用的高风险漏洞。当用户需要对 SCA 扫描结果降噪、漏洞优先级排序、或供应链风险评估时使用。
- Works in 5 steps: 可利用性评估 → 攻击向量分析 → 影响分类（优先级排序） → …
- Security work in your project
- SKILL.md covers 输入格式, 优先级框架（严格标准）, 评估维度 and 噪音过滤规则, plus 2 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Sca AI Denoise is an agent skill from xwtro0tk1t-cloud/harness. SCA 漏洞 AI 降噪与风险优先级评估。对 Grype/Snyk/Xray 等 SCA 工具的漏洞发现进行多维度风险评估，按 P0-P3 分级，过滤噪音（DoS、本地提权、低影响信息泄露），聚焦真正可利用的高风险漏洞。当用户需要对 SCA 扫描结果降噪、漏洞优先级排序、或供应链风险评估时使用。
Its SKILL.md is about 790 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security. It works with Snyk and SQL. The repository describes itself as: Harness is an AI Agent development guardrail Meta-Skill that establishes four layers of defense for any project in one command: knowledge management, architecture constraints…
When your agent uses it
- Security work in your project
Example prompts
- “/sca-ai-denoise”
Workflow steps
5 steps, taken from the step headings in SKILL.md.
- 可利用性评估
- 攻击向量分析
- 影响分类（优先级排序）
- 业务影响
- 供应链风险
What it can do on your machine
Read from SKILL.md and the folder at commit 3e8bb50. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are json).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Sca AI Denoise loads about 787 tokens when it runs. Until then it costs about 41 tokens; SKILL.md has 225 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 225 words (~787 tokens).
“对 SCA (Software Composition Analysis) 扫描结果进行 AI 驱动的风险评估与降噪。”
- name
- sca-ai-denoise
Files
Just SKILL.md in bundled-skills/sca-ai-denoise of xwtro0tk1t-cloud/harness.
Open the folder on GitHubat commit 3e8bb50
Compare with similar skills
Sca AI Denoise next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Sca AI Denoise this skillxwtro0tk1t-cloud/harness | 265 | — | ~787 | Automated safety check: Pass | None | |
| Security AuditAedelon/claude-code-blueprint | 120 | — | ~1.6k | Automated safety check: Notes | Custom licence | |
| Supply Chain Securityzhaoxuya520/reverse-skill | 40k | 4 repos | ~953 | Automated safety check: Warn | MIT | |
| Secknowledge SkillPa55w0rd/secknowledge-skill | 424 | — | ~2.7k | Automated safety check: Pass | None | |
| SecskillsArenbai/SecSkills | 251 | — | ~1.8k | Automated safety check: Notes | MIT | |
| Php Audit Pipeline0xShe/PHP-Code-Audit-Skill | 402 | 1 repos | ~4.9k | Automated safety check: Pass | None |
Similar skills
Supply Chain Security
zhaoxuya520/reverse-skill
A skill your agent uses for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
Secknowledge Skill
Pa55w0rd/secknowledge-skill
Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。
Secskills
Arenbai/SecSkills
渗透测试实战技能 v1.3.0。覆盖信息收集、全类漏洞发现（注入全家桶/SSRF/文件类/反序列化/SSTI/越权逻辑/CSRF）、漏洞利用、后渗透、免杀全流程。
Php Audit Pipeline
0xShe/PHP-Code-Audit-Skill
PHP Web 全链路白盒代码安全审计流水线（多文件版编排）。作为总编排参考，按 Sink 类型调用各子审计 skill（php-route-mapper/php-auth-audit/php-route-tracer/php--audit），并复用统一输出与分级标准。
Code Security Audit
ProgrammerAnthony/Expert-Coding-Harness
A skill your agent uses when 用户需要对代码进行安全审计、发现安全漏洞、上线前安全评估、检查代码是否存在安全风险时。触发场景：代码安全审计、安全审计、白盒审计、安全扫描、漏洞检测、漏洞挖掘、SQL注入、命令注入、XSS、SSRF、反序列化、认证绕过、越权、代码安全检查、security audit、code…
More from xwtro0tk1t-cloud/harness
Design Review
xwtro0tk1t-cloud/harness
Dispatch an independent challenger agent to adversarially review a spec or implementation plan against the actual codebase.
Explore
xwtro0tk1t-cloud/harness
Graph-driven project understanding using code-review-graph (CRG).
Graph
xwtro0tk1t-cloud/harness
Manage code knowledge graphs via code-review-graph (CRG). An agent skill from xwtro0tk1t-cloud/harness.
Security Review Skill Creator
xwtro0tk1t-cloud/harness
生成安全审计 skill。两种模式：(1) 项目模式——根据项目文档生成定制化审计 skill；(2) 通用模式——仅指定语言+框架，从参考资料库生成通用审计 skill。当用户想创建安全审计 skill、生成审计规则、或提到"生成安全审计skill"、"创建code review skill"、"生成 Java 审计 skill"时使用。
Security Review Skill For Terraform
xwtro0tk1t-cloud/harness
审计 Terraform / IaC 代码安全（AWS 基础设施）。检测硬编码凭据、过宽 Security Group(0.0.0.0/0)、IAM 权限过大(Action/Resource )、S3 公开访问、RDS 未加密/公开、State 文件泄露、ECS/EKS 容器特权、CloudTrail/VPC FlowLog 缺失、不安全 Provider/Module 引用等。当审计…
Security Review Skill For Docker
xwtro0tk1t-cloud/harness
审计 Docker/容器部署安全。检测 Dockerfile、docker-compose.yml、Kubernetes manifests 中的安全问题：特权容器、root 运行、敏感挂载、资源无限制、密钥泄露、Base Image 不合规、网络暴露等。当审计容器配置、Docker 安全、K8s 部署安全、或检查基础设施安全时使用。支持…
Related
Categories
Questions about Sca AI Denoise
What does Sca AI Denoise do?
SCA 漏洞 AI 降噪与风险优先级评估。对 Grype/Snyk/Xray 等 SCA 工具的漏洞发现进行多维度风险评估，按 P0-P3 分级，过滤噪音（DoS、本地提权、低影响信息泄露），聚焦真正可利用的高风险漏洞。当用户需要对 SCA 扫描结果降噪、漏洞优先级排序、或供应链风险评估时使用。. Sca AI Denoise is an agent skill from xwtro0tk1t-cloud/harness.
When should I use Sca AI Denoise?
Sca AI Denoise fits situations like: security work in your project.
How do I install Sca AI Denoise in Claude Code?
Run `npx skills add xwtro0tk1t-cloud/harness --skill sca-ai-denoise -a claude-code`. Or copy the skill folder (bundled-skills/sca-ai-denoise in xwtro0tk1t-cloud/harness) into .claude/skills/sca-ai-denoise in your project. Claude Code loads it when a task matches its description.
How do I install Sca AI Denoise in Codex?
Run `npx skills add xwtro0tk1t-cloud/harness --skill sca-ai-denoise -a codex`. Or copy the skill folder (bundled-skills/sca-ai-denoise in xwtro0tk1t-cloud/harness) into .agents/skills/sca-ai-denoise in your project. Codex loads it when a task matches its description.
Can I use Sca AI Denoise in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add xwtro0tk1t-cloud/harness --skill sca-ai-denoise -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sca-ai-denoise, .gemini/skills/sca-ai-denoise, .github/skills/sca-ai-denoise and .opencode/skills/sca-ai-denoise in your project.
What does Sca AI Denoise need to run?
SKILL.md names no scripts, command-line tools or credentials: Sca AI Denoise is instructions for the agent only.
Does Sca AI Denoise access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Sca AI Denoise safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Sca AI Denoise use?
No licence was found for Sca AI Denoise or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does Sca AI Denoise use?
About 787 tokens (SKILL.md is roughly 3.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Sca AI Denoise?
Skills that share tags, products or a category with Sca AI Denoise: Security Audit (Aedelon/claude-code-blueprint, 120 stars), Supply Chain Security (zhaoxuya520/reverse-skill, 40k stars), Secknowledge Skill (Pa55w0rd/secknowledge-skill, 424 stars) and Secskills (Arenbai/SecSkills, 251 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Sca AI Denoise?
xwtro0tk1t-cloud (a GitHub user) maintains it in xwtro0tk1t-cloud/harness, which has 265 GitHub stars. The repository holds 7 skills in this directory. The repository was last updated on May 4, 2026.
Source: xwtro0tk1t-cloud/harness on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.